last executing test programs: 9.276896021s ago: executing program 4 (id=5179): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x4, 0x4, 0x5}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x10000, 0x0, r2, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3}, 0x50) (async) r3 = syz_usb_connect(0x2, 0x36, &(0x7f00000005c0)={{0x12, 0x1, 0x0, 0x3a, 0x37, 0x5, 0x20, 0x781, 0x5, 0x5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xe6, 0x2, 0x2, 0x5b, 0xbd, 0x97, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r3, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000000)={0x20, 0x11, 0x1, "f8"}, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r3, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000240)={0x20, 0xc, 0x1, "b2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r3, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000700)={0x0, 0xf, 0xc, "c2e34548f492f2001d7fefdc"}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0x9, 0x1, 0xb1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x0, 0x0, 0x2007) syz_usb_control_io$printer(r3, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) (async) read$FUSE(0xffffffffffffffff, &(0x7f0000000380)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x4, r4, 0x2, &(0x7f0000000000)) 8.440886279s ago: executing program 2 (id=5186): pipe2(&(0x7f00000000c0), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x200080, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000180)={0xa0, 0xfffffffffffffff5, 0x0, {{0x4, 0x1, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0xff, 0x5, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000004}, 0x4040010) add_key(&(0x7f0000000040)='pkcs7_test\x00', 0x0, &(0x7f00000000c0)="100c06", 0x3, 0xfffffffffffffffe) 7.968907318s ago: executing program 4 (id=5187): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getown(r1, 0x9) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000180)={0xb, 0x5}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeec, 0x8031, r0, 0xca5fc000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) lstat(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000481000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) 6.713714491s ago: executing program 1 (id=5193): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x8000000, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xc4}}, 0x0) 6.44900572s ago: executing program 1 (id=5195): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c00000010004b0400f4ed00000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b00010062726964676500001c000280080004"], 0x4c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb001480080017"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 6.435663348s ago: executing program 2 (id=5196): eventfd2(0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001f80), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000001fc0)={0x42, 0x3, 0x0, {0x0, 0x21, 0x0, '/proc/sys/net/ipv4/vs/secure_tcp\x00'}}, 0x42) r1 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r1, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0xbe5ad000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 6.244672389s ago: executing program 1 (id=5198): r0 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) syz_open_dev$sndpcmp(&(0x7f0000000000), 0x3, 0x183a00) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="60000000020603000000000000830000000000000900020073797a31000000000500010007000000050005000a00000014000780080013400000000008001240ffffffff12000300686173683a6e65742c706f7274000000050004"], 0x60}, 0x1, 0x0, 0x0, 0xc0c0}, 0x0) (fail_nth: 2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x5c}}, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x5, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x7, 0x81}, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000700)='/proc/bus/input/handlers\x00', 0x0, 0x0) pread64(r5, 0x0, 0x0, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) socket$packet(0x11, 0x2, 0x300) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x786c0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f00000000c0)=@x86={0xa4, 0xec, 0x28, 0x0, 0x7, 0x3, 0x8, 0x7, 0x7, 0xc2, 0xfd, 0x9, 0x0, 0xc6, 0x10, 0x85, 0x97, 0x4, 0x2, '\x00', 0x1, 0x6}) syz_usb_disconnect(r0) r7 = fsopen(&(0x7f00000003c0)='tracefs\x00', 0x1) syz_usb_disconnect(r0) close_range(r7, 0xffffffffffffffff, 0x0) 6.20639423s ago: executing program 4 (id=5199): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}, 0x1, 0x0, 0x0, 0x51}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r1, 0xffffffffffffffff, 0x41) 5.777149514s ago: executing program 4 (id=5200): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b4000000000000006111500008000000060000000000000095"], &(0x7f0000000080)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r3, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r6], 0x54}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000001000250800170000000000000a000000", @ANYRES32=r9], 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@dellink={0x20, 0x11, 0x1, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, 0x8010, 0x602a1}}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 5.267908276s ago: executing program 2 (id=5202): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) 5.236741449s ago: executing program 3 (id=5203): bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='\n\x00'/12, @ANYRES32=0x0, @ANYBLOB="aec6bf8898"], 0x20) syz_emit_ethernet(0x82, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffff1711b45adbde08004500f5675ebdd99c00740000000000019078ac1e0001ac1414aa05009078e0ef00e0460000000000000000110000ac1414aa000000008903ac070300010000030a01010400000000e000000200000000ac1414bb00000000ac1414bb000000000000000000000000ac1414000000800000000000"], 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000004c0)={{0x12, 0x1, 0x0, 0xfb, 0x15, 0x49, 0x20, 0xb48, 0x1008, 0x3d42, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x8, 0x84, 0x11}}]}}]}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fremovexattr(0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$KVM_SET_MSRS(r1, 0xc008ae88, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000050000f58504"]) socket(0x2, 0xa, 0xfffffffb) socket$nl_audit(0x10, 0x3, 0x9) 4.823903069s ago: executing program 0 (id=5204): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974"], 0xdc}, 0x1, 0x0, 0x0, 0x51}, 0x0) 4.774237472s ago: executing program 2 (id=5205): socket$netlink(0x10, 0x3, 0x0) socket(0x2c, 0x803, 0x0) socket$tipc(0x1e, 0x4, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_smc(0x2b, 0x1, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_route(0x10, 0x3, 0x0) socket(0x2c, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda9880ffe00002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x64}}, 0x0) (fail_nth: 9) 4.455435584s ago: executing program 1 (id=5206): syz_usb_connect(0x0, 0xb6, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x87, 0x3a, 0x57, 0x10, 0x5c6, 0x9215, 0x7072, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa4, 0x1, 0x0, 0x0, 0xf8, 0x0, [{{0x9, 0x4, 0x98, 0x6, 0x0, 0x3, 0x9d, 0x6e, 0x0, [@generic={0x6d, 0x23, "ddba78610bdf75376a769f60a46b0b27d3e832f171d3b7ccb925a25a61d36d4354f95248897a4d919710d253b0060c3b1a7cdc6b323beef0068ca44247f816fdf115dfce026646a7bf123e83fe3d4089594580a996d1094a4e1e45c369920b574e479a44e5f33f7e882e05"}, @uac_control={{0xa, 0x24, 0x1, 0x3, 0x3}, [@output_terminal={0x9, 0x24, 0x3, 0x4, 0x100, 0x3, 0x1}, @selector_unit={0x6, 0x24, 0x5, 0x4, 0x3, 'l'}, @processing_unit={0xd, 0x24, 0x7, 0x3, 0x3, 0x3, "3f81e8c77a67"}]}]}}]}}]}}, 0x0) 4.314227283s ago: executing program 0 (id=5207): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x41, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x40200, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSSOFTCAR(r3, 0x5433, 0x0) listen(r2, 0x4) io_setup(0x2007, &(0x7f0000000980)) eventfd2(0x0, 0x0) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x300, 0x0, 0xa8d0}, 0x0, 0x0, 0x0, 0x0) ioctl$EVIOCGRAB(r4, 0x40044590, &(0x7f0000000140)=0x2) r5 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x8, 0x3, 0x250, 0x0, 0xa, 0x148, 0x0, 0x60, 0x1b8, 0x2a8, 0x2a8, 0x1b8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0xb8, 0x120, 0x0, {0x200003ae, 0x7f00}, [@common=@socket0={{0x20}}, @common=@unspec=@pkttype={{0x28}, {0x6, 0xe}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x6, 0x3, 0x81, 'snmp_trap\x00', 'syz0\x00', {0x30f6a663}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x2b0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r6, 0x114, 0x3, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230000) socket$inet_sctp(0x2, 0x5, 0x84) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r7 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) process_vm_writev(r7, &(0x7f0000001c80), 0x0, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x74}], 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x2}, &(0x7f0000000040)=0x8) 4.291375889s ago: executing program 4 (id=5208): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_clone(0x20042400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r1) tkill(r1, 0x12) ptrace(0x4208, r1) ptrace$PTRACE_SETSIGMASK(0x420b, r1, 0x0, 0x0) setpgid(r0, r0) waitid(0x2, r0, 0x0, 0x4, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000004c0)={0x1, 0x80000001}, 0x8) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) close(r2) pwrite64(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0xfecc) ioctl$SNDRV_PCM_IOCTL_REWIND(0xffffffffffffffff, 0x40084146, &(0x7f0000000000)=0xb) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x149482, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x256c, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000002540)={0x24, 0x0, 0x0, &(0x7f00000013c0)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x9, "83c5b03b"}]}}, 0x0}, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000340)={0x24, 0x0, &(0x7f00000000c0)={0x0, 0x3, 0x2, @lang_id={0x0, 0x3, 0x423}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io(r6, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xf, 0x0, 0x0, 0x6}, 0x94) 3.600850093s ago: executing program 2 (id=5209): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getown(r1, 0x9) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000180)={0xb, 0x5}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeec, 0x8031, r0, 0xca5fc000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) lstat(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000481000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) 2.888455568s ago: executing program 0 (id=5210): ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000800)={0x0, 0x5, 0x32a71251, 0x765}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffd}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x2, 0x4) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat(0xffffffffffffff9c, 0x0, 0x40, 0x0) io_submit(0x0, 0x1, &(0x7f0000000700)=[&(0x7f0000000440)={0x18, 0x700fbff, 0x4, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000180)}]) sendto$packet(r3, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x100020000, &(0x7f0000000540)={0xc9, 0x0, r4, 0x1, 0x0, 0x6, @multicast}, 0x14) bind$can_j1939(r0, 0x0, 0x0) 2.605006178s ago: executing program 3 (id=5211): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=@newlink={0x38, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x3, 0x410c9}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @multicast2}]}}}]}, 0x38}, 0x1, 0x0, 0xff7f, 0x4008000}, 0x4008040) 2.474109526s ago: executing program 2 (id=5212): creat(&(0x7f0000000000)='./file0\x00', 0x108) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sysinfo(&(0x7f00000001c0)=""/233) read$FUSE(r0, &(0x7f0000006340)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x1, 0xc18da8, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x2, 0x4, 0x1, 0x1, 0x500}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, r2}, 0x38) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0xa4901, 0x0) r4 = dup2(r3, r0) syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000002c0)=[@text32={0x20, 0x0}], 0x1, 0x10, 0x0, 0x0) r5 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x319c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f0000000400)={0x2c, &(0x7f0000000000)={0x0, 0x0, 0x7, {0x7, 0x0, "5a7da32917"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2.324990496s ago: executing program 3 (id=5213): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7050000000006006110440000000000dc0500001000000095000000000000009abb1723bf24203831c9545b21c751ee4024f479cbe4b89f9808837203000000000000c2d182c7a3221481f5009edaf5f5ac058299e10e790a198f42a715b99fb3d2a73dd025848710155ad1efd7d991408000000000000085a0db0401fa29e075b7ab0408a0d8cfceeb23465bb027ee1151c02af21d8f9aa57e673a6724441d08087aff070eda8abef22b3a806c8226f5a2886c93bd29b37252ba4a6e9cc5f69e75680c431aa855e487ae513abd6c4ee973fce29a26018ed5e0780f8778a602a3533a3dac7da4fe491edf3abfa7bf871c58848ac46ada6776bd9b85df01e626026a59ddfa7a9c879acbfb0bf426785dec7d8611dc850df49ed8633bdb83dd505fb20649f53841a0e200c91f5bf1bb186ed87efc7b6f8859d029c8376ca19265e281fea0a6fd2222f8850c8445758503ede0ce1b3f73ecd8989e8c53c5e679b13802bddf80f3b1d07d6d68bfa12ab34697d40ac1150a842f8bb381344b994c19642a10eb30845a993daaa8bd4aebc595475feb3475d8e802498382e73edb98fcf2df96ab3c870490c4"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) 2.298892272s ago: executing program 1 (id=5214): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0x503, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xef}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp=r3}]}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x40}, 0x1, 0x80000000000}, 0x0) 2.236201211s ago: executing program 3 (id=5215): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8040}, 0x0) 2.036817809s ago: executing program 3 (id=5216): socket$netlink(0x10, 0x3, 0x0) socket(0x18, 0x803, 0x0) socket$tipc(0x1e, 0x4, 0x0) socket$tipc(0x1e, 0x5, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) syz_open_dev$evdev(&(0x7f0000001900), 0x0, 0x0) syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) socket(0x2c, 0x3, 0x0) socket$igmp6(0xa, 0x3, 0x2) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda9880ffe00002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}}, 0x0) 1.01795138s ago: executing program 0 (id=5217): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808"], 0xdc}, 0x1, 0x0, 0x0, 0x51}, 0x0) 931.277209ms ago: executing program 0 (id=5218): r0 = socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_io_uring_setup(0x20186, &(0x7f0000000580)={0x0, 0xcf9, 0x20, 0x7fffff, 0xae2}, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000080)=ANY=[]) r3 = socket$inet(0x2, 0x80001, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_io_uring_setup(0x466c, &(0x7f0000000280)={0x0, 0x0, 0x10100}, &(0x7f0000001340)=0x0, &(0x7f0000000140)=0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r7, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000400)=@IORING_OP_SYMLINKAT={0x26, 0x20, 0x0, r7, &(0x7f0000000540)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x1}) io_uring_enter(r4, 0x2d3e, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r9, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r10 = socket$inet(0x2, 0x3, 0x33) ioctl$PTP_EXTTS_REQUEST2(0xffffffffffffffff, 0xc0603d06, &(0x7f0000000000)={0x6, 0xb}) getsockopt$inet_mreqsrc(r10, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) setsockopt$inet_tcp_int(r9, 0x6, 0x10, &(0x7f0000000080)=0xd, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r9, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @mss, @sack_perm, @timestamp, @sack_perm, @mss, @timestamp, @sack_perm], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f00000001c0), 0x4) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000000)={r8, 0xfffa}, 0x8) socket$nl_route(0x10, 0x3, 0x0) 824.562144ms ago: executing program 1 (id=5219): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) dup(r1) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454c9, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x14, &(0x7f0000000140)={0xffffffffffffffff}, 0x106, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r4, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0xe24, 0x0, @mcast2, 0x12}, r5}}, 0x30) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x3}, 0x0) fsopen(0x0, 0x0) r6 = socket$inet(0x2, 0xa, 0x1040) r7 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newqdisc={0x45c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r9, {0x0, 0x3}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0x0, 0xff, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0x4ff68f09, 0x5, 0x10000000}}, @TCA_TBF_PTAB={0x404, 0x3, [0x1, 0x3, 0x9, 0x648, 0x6643, 0x4, 0x2, 0x3, 0x9, 0x6, 0x1, 0x7, 0x916, 0x80, 0x3, 0x1000, 0x7, 0xf5, 0x1, 0x4, 0x3, 0x8a50, 0x7fffffff, 0xb, 0x7fffffff, 0x9, 0x6, 0x7f, 0x2, 0x3, 0x0, 0x2, 0xe17b, 0x101, 0x2, 0xfb5, 0x5, 0x7, 0x3, 0x6, 0xc0, 0x7fffffff, 0x4, 0x41, 0x81, 0x40, 0x2, 0xb, 0x101, 0xbd, 0xa33e, 0xb66, 0xfffffff9, 0x3ffc0000, 0x5, 0xc3, 0x5, 0x4, 0xc90, 0x5, 0x14, 0x1, 0x2, 0x9, 0x10, 0x9, 0x10001, 0x7, 0xffff, 0xbd0e, 0x0, 0x2, 0xf6, 0x4, 0x6, 0x0, 0x1, 0x2, 0xba, 0x7fffffff, 0xf, 0x8, 0x4, 0x1, 0xd72, 0xf0, 0x62, 0x6, 0x8, 0xacbb, 0x8, 0x203, 0x4, 0x0, 0x4, 0x1, 0xb83, 0x5, 0xfffffe00, 0x9, 0x0, 0x2, 0x8000, 0x0, 0x4, 0x3, 0x1, 0x1a93, 0x40, 0xfb3, 0x2ff, 0x1, 0x5, 0xfffffff8, 0x7, 0x6, 0x0, 0xb, 0x10001, 0x10, 0xf, 0x122671a9, 0x8, 0x99, 0x2, 0x7, 0x400006, 0x8, 0xa, 0x80, 0x4, 0x3267, 0x38369466, 0xd9, 0x7, 0x3, 0x0, 0x3, 0x3, 0x7, 0x80000001, 0x48d, 0x51c, 0x631603d7, 0xb5be, 0x1, 0x2, 0x10001, 0x4, 0x4, 0x8, 0x4, 0x6, 0x9, 0x569, 0x1, 0x10000, 0x2, 0x7, 0x0, 0x1, 0x1, 0x1, 0x5, 0x803, 0x5, 0x5, 0xffffffff, 0x5, 0x7, 0x1, 0xfffffff2, 0x0, 0x3ff, 0x5, 0x7f, 0xfffffffb, 0x83, 0x4, 0x9, 0xffff, 0xfda, 0x5, 0xb, 0x4, 0xe0b, 0x7fff, 0x7, 0x7ff, 0x7, 0xffffff84, 0xd14, 0x0, 0x4, 0xfffffff8, 0x6, 0x0, 0x36, 0x2, 0x6245, 0x1, 0x1, 0x10000, 0x9, 0x9, 0x2, 0x3bc3, 0x6, 0x4, 0x6, 0x666, 0x995, 0x8, 0x840, 0x2, 0x4d8a6474, 0x3, 0x7, 0x6, 0x3, 0x0, 0x8, 0x81, 0xc78, 0x2, 0x7, 0x2, 0x8, 0x6, 0x2f72, 0x10000, 0xd, 0x536a, 0x8, 0x4, 0xff, 0x9, 0x3f9a, 0x2, 0xfffffffb, 0x4, 0x5, 0x1, 0xedf, 0x10000, 0xfffffff9, 0x1ff, 0x4, 0x100, 0x2, 0x3, 0x7, 0x2, 0x6, 0x6, 0x80000000]}]}}]}, 0x45c}}, 0x44080) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x24, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r9, {}, {0xffe0, 0xa}, {0x1, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x55}, 0x4000) r10 = fsopen(&(0x7f0000000080)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) r11 = fsmount(r10, 0x0, 0xf) quotactl_fd$Q_GETQUOTA(r11, 0xffffffff80000701, 0x0, 0x0) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @empty}, 0x10) socket$netlink(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000010000100000000000000000300000a1c000000120a0104000000000000000001000001080003400000000a140000001100010000000000000000000000000aebfc2c268d9f5bb50ffa408512194509a54cb002f7caaffb6e575f3585fec248a570832a9788f205826a23aa865d8cf878e6d83bc7a973964c38b191ece4276d4250a7f10a41660a32637a79faa526ca043692dda4ca7139b83c06c6b164456e5abb297276c57a084ad088f6e602ed3c4f0ad61b8a1b05db052a77d666166a2519647f00d9adf82eae5b95589f333b3d83cc1c2612963e54335bc7a1814f237f857b33578f96f1a8c21f3186af8b88a2e78b043b94f54de65a20cfbe44da84ec117ed17c31da7cdbee164c237f1d27aa3727e126b7d0395cb9b1e52109e3cf97c395862c21676215f49635af4cf0b22b2d73ffce89cd838b53dd2685d436c35aa436ad5a2c78c43477316f49b55c36afdfb47302d4b33961e91dc7598a2a809733acf246e8ffa100"], 0x44}, 0x1, 0x0, 0x0, 0x4c050}, 0x40) 822.875627ms ago: executing program 3 (id=5220): r0 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0x0) ftruncate(r0, 0x51a9497) ioctl$KVM_RUN(r0, 0xae80, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x69) syz_open_dev$vim2m(0x0, 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vbi(0x0, 0x0, 0x2) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fc5c7208030478fa1b710000000109021200010000900009048200004a64e200"], 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x5, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0x8, 0x10, &(0x7f0000000000)={0x1}, 0x10}, 0x94) accept4(r3, 0x0, 0x0, 0x80000) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000140)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0xffffffff, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}, {0xf}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x14, 0x2, [@TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x800}, @TCA_HHF_RESET_TIMEOUT={0x8, 0x4, 0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x44000}, 0x9000) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000080)) r6 = gettid() syz_pidfd_open(r6, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x98, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000540)='./cgroup/pids.max\x00', 0x2, 0x0) r8 = syz_io_uring_setup(0xed0, &(0x7f0000000400)={0x0, 0x100002, 0x10300, 0x2}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r8, 0xa3d, 0x0, 0x0, 0x0, 0xff39) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r7, 0xc02c564a, &(0x7f0000000040)={0x106, 0x3234564e, 0x3, @stepwise={0x3, 0xfffff801, 0x5, 0x8d6f, 0x2, 0x4}}) 487.910971ms ago: executing program 0 (id=5221): creat(0x0, 0x109) r0 = syz_open_dev$dri(0x0, 0x1f, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x22083, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd7000000000000400000013031780"], 0x328}}, 0x84) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) rseq(&(0x7f00000004c0), 0x20, 0x0, 0x0) getrlimit(0x8, &(0x7f00000000c0)) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x2, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [0x0, 0x0, 0x290], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0x10000000, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}, {0x0, 0x3}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x206, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x101001) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) getpeername(r6, 0x0, &(0x7f00000000c0)) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, 0x0, 0x20000000) 0s ago: executing program 4 (id=5222): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getown(r1, 0x9) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r0, 0x0, r2, 0x0, 0x4ffe2, 0x0) ioctl$VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000180)={0xb, 0x5}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeec, 0x8031, r0, 0xca5fc000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) lstat(0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000481000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000003, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): b 2-1: Using ep0 maxpacket: 32 [ 1360.477534][T20219] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 1360.490062][T26542] kvm: pic: non byte write [ 1360.498499][T20219] usb 2-1: config 0 has no interface number 0 [ 1360.514201][T20219] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1360.523512][ T5895] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 1360.531389][T20219] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.540466][T20219] usb 2-1: Product: syz [ 1360.545132][T20219] usb 2-1: Manufacturer: syz [ 1360.560772][T20219] usb 2-1: SerialNumber: syz [ 1360.580192][T20219] usb 2-1: config 0 descriptor?? [ 1360.589613][T20219] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1360.706259][ T5895] usb 5-1: Using ep0 maxpacket: 8 [ 1360.716399][ T5895] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1360.736156][ T5895] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1360.770405][ T5895] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1360.796052][ T5895] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1360.825261][T20219] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1360.838632][ T5895] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1360.883393][T20219] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1360.902039][ T5895] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1360.954919][ T5895] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1361.016639][ T2153] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 1361.224076][ T5895] usb 5-1: GET_CAPABILITIES returned 0 [ 1361.235942][ T2153] usb 4-1: Using ep0 maxpacket: 16 [ 1361.297280][T26568] xt_hashlimit: max too large, truncated to 1048576 [ 1361.306447][ T5895] usbtmc 5-1:16.0: can't read capabilities [ 1361.313301][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1361.324179][ T5991] usb 2-1: USB disconnect, device number 115 [ 1361.338755][ T5991] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1361.351037][ T2153] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1361.375537][ T2153] usb 4-1: config 0 has no interface number 0 [ 1361.397334][ T2153] usb 4-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1361.409980][ T5991] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1361.527031][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.535975][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.546019][ T2153] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.557115][ T5991] quatech2 2-1:0.51: device disconnected [ 1361.562116][T12480] usb 5-1: USB disconnect, device number 115 [ 1361.564472][ T2153] usb 4-1: Product: syz [ 1361.589830][ T2153] usb 4-1: Manufacturer: syz [ 1361.594605][ T2153] usb 4-1: SerialNumber: syz [ 1361.645109][ T2153] usb 4-1: config 0 descriptor?? [ 1361.684527][ T2153] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1361.704655][T26568] xt_bpf: check failed: parse error [ 1361.931166][T26623] netlink: 'syz.0.4874': attribute type 1 has an invalid length. [ 1361.999948][T26629] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4874'. [ 1362.099213][ T2153] gspca_spca1528: reg_w err -71 [ 1362.146637][ T2153] spca1528 4-1:0.1: probe with driver spca1528 failed with error -71 [ 1362.170547][ T2153] usb 4-1: USB disconnect, device number 100 [ 1362.189246][T26644] bond5 (unregistering): Released all slaves [ 1363.096175][ T2153] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 1363.153683][T26719] geneve2: entered promiscuous mode [ 1363.160973][T26719] geneve2: entered allmulticast mode [ 1363.328444][ T2153] usb 4-1: device descriptor read/64, error -71 [ 1363.628238][T26736] netlink: 548 bytes leftover after parsing attributes in process `syz.2.4881'. [ 1363.736520][ T2153] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 1363.887972][ T2153] usb 4-1: device descriptor read/64, error -71 [ 1363.996389][ T2153] usb usb4-port1: attempt power cycle [ 1364.618386][ T2153] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 1364.659587][ T2153] usb 4-1: device descriptor read/8, error -71 [ 1364.907142][ T2153] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 1364.976470][ T2153] usb 4-1: device descriptor read/8, error -71 [ 1365.166432][ T2153] usb usb4-port1: unable to enumerate USB device [ 1365.566076][ T1225] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 1365.613398][ T30] audit: type=1326 audit(1750898413.283:2331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1365.670602][ T30] audit: type=1326 audit(1750898413.313:2332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1365.728149][ T30] audit: type=1326 audit(1750898413.313:2333): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1365.731077][ T1225] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1365.763178][ T30] audit: type=1326 audit(1750898413.313:2334): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1365.796567][ T1225] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1365.807112][ T1225] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1365.858107][ T30] audit: type=1326 audit(1750898413.313:2335): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=18 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1365.986846][ T1225] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1366.043793][ T1225] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1366.055423][ T30] audit: type=1326 audit(1750898413.313:2336): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1366.078956][ T30] audit: type=1326 audit(1750898413.313:2337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f89bef8d290 code=0x7ffc0000 [ 1366.104693][ T1225] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1366.115305][ T1225] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1366.131170][ T1225] usb 5-1: Product: syz [ 1366.142552][ T30] audit: type=1326 audit(1750898413.313:2338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1366.165931][ T1225] usb 5-1: Manufacturer: syz [ 1366.220365][ T1225] cdc_wdm 5-1:1.0: skipping garbage [ 1366.234869][ T1225] cdc_wdm 5-1:1.0: skipping garbage [ 1366.236245][ T2153] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1366.262893][T26768] fuse: Bad value for 'fd' [ 1366.277408][ T1225] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1366.290723][ T30] audit: type=1326 audit(1750898413.313:2339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1366.315296][ T1225] cdc_wdm 5-1:1.0: Unknown control protocol [ 1366.383512][ T30] audit: type=1326 audit(1750898413.313:2340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26752 comm="syz.2.4884" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89bef8e929 code=0x7ffc0000 [ 1366.415943][ T2153] usb 1-1: Using ep0 maxpacket: 16 [ 1366.440186][ T2153] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1366.487672][ T2153] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.529623][ T2153] usb 1-1: Product: syz [ 1366.533814][ T2153] usb 1-1: Manufacturer: syz [ 1366.566228][ T5895] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 1366.613850][ T2153] usb 1-1: SerialNumber: syz [ 1366.650925][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1366.656674][ T5991] usb 5-1: USB disconnect, device number 116 [ 1366.657598][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1366.669681][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1366.678999][ C0] dummy_hcd dummy_hcd.4: timer fired with no URBs pending? [ 1366.853914][T26783] netlink: 'syz.2.4887': attribute type 1 has an invalid length. [ 1366.875993][ T5895] usb 4-1: Using ep0 maxpacket: 8 [ 1366.901443][ T2153] r8152-cfgselector 1-1: Unknown version 0x0000 [ 1366.932228][ T5895] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 1366.945330][ T2153] r8152-cfgselector 1-1: config 0 descriptor?? [ 1366.976476][ T5895] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1367.009219][ T5895] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1367.020910][ T5895] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1367.036262][ T5895] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1367.077270][ T5895] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1367.092933][ T5895] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1367.247078][T26783] bond3: entered promiscuous mode [ 1367.252490][T26783] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1367.283518][ T2153] r8152-cfgselector 1-1: Unknown version 0x0000 [ 1367.536835][ T2153] r8152-cfgselector 1-1: bad CDC descriptors [ 1367.561359][ T5895] usb 4-1: GET_CAPABILITIES returned 0 [ 1367.581342][T26758] pim6reg: entered allmulticast mode [ 1367.603133][ T5895] usbtmc 4-1:16.0: can't read capabilities [ 1367.691842][T26757] pim6reg: left allmulticast mode [ 1367.740567][ T5895] usb 4-1: USB disconnect, device number 105 [ 1367.786371][T26838] netlink: 'syz.2.4888': attribute type 1 has an invalid length. [ 1367.839381][T26842] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4888'. [ 1367.965860][T26847] bond4 (unregistering): Released all slaves [ 1368.564531][T26930] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4892'. [ 1368.760324][T12480] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 1368.946078][T12480] usb 4-1: Using ep0 maxpacket: 32 [ 1368.960468][ T2153] r8152-cfgselector 1-1: USB disconnect, device number 98 [ 1368.998029][T26925] loop2: detected capacity change from 0 to 3 [ 1369.022713][T24245] ldm_validate_privheads(): Disk read failed. [ 1369.036624][ T5895] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1369.046060][T24245] Dev loop2: unable to read RDB block 3 [ 1369.060484][T24245] loop2: unable to read partition table [ 1369.074174][T24245] loop2: partition table beyond EOD, truncated [ 1369.102274][T26946] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4895'. [ 1369.130717][T26925] ldm_validate_privheads(): Disk read failed. [ 1369.147166][T26925] Dev loop2: unable to read RDB block 3 [ 1369.165352][T26950] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4895'. [ 1369.174755][T26925] loop2: unable to read partition table [ 1369.182957][T26946] macvtap2: entered promiscuous mode [ 1369.189495][T26925] loop2: partition table beyond EOD, truncated [ 1369.196137][ T5895] usb 2-1: Using ep0 maxpacket: 8 [ 1369.211360][T26946] bond0: entered promiscuous mode [ 1369.214863][ T5895] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1369.218930][T26925] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1369.265417][ T5895] usb 2-1: config 0 has no interfaces? [ 1369.275670][T26946] bond_slave_0: entered promiscuous mode [ 1369.288470][ T5895] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1369.322370][ T5895] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1369.347512][T26946] bond_slave_1: entered promiscuous mode [ 1369.374410][ T5895] usb 2-1: config 0 descriptor?? [ 1369.385115][T12480] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1369.387749][T26946] bridge0: entered promiscuous mode [ 1369.428240][T12480] usb 4-1: too many configurations: 105, using maximum allowed: 8 [ 1369.441037][T26957] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4896'. [ 1369.462060][T26946] macvtap2: entered allmulticast mode [ 1369.481893][T26946] bond0: entered allmulticast mode [ 1369.486135][T12480] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1369.496736][T26957] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4896'. [ 1369.516579][T26946] bond_slave_0: entered allmulticast mode [ 1369.529101][T12480] usb 4-1: can't read configurations, error -71 [ 1369.544098][T26946] bond_slave_1: entered allmulticast mode [ 1369.562956][T26946] bridge0: entered allmulticast mode [ 1369.593345][T26946] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 1369.632054][T26934] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1369.661390][T26950] bond0: left allmulticast mode [ 1369.816830][T26934] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1369.826560][T26950] bond_slave_0: left allmulticast mode [ 1369.837867][T26934] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1369.861816][T26950] bond_slave_1: left allmulticast mode [ 1369.867429][T26950] bridge0: left allmulticast mode [ 1369.880321][T26950] bond0: left promiscuous mode [ 1370.056833][T26934] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1370.070111][T26950] bond_slave_0: left promiscuous mode [ 1370.075763][T26950] bond_slave_1: left promiscuous mode [ 1370.109628][ T5991] usb 2-1: USB disconnect, device number 116 [ 1370.144959][T26950] bridge0: left promiscuous mode [ 1370.220859][T26979] Cannot find set identified by id 0 to match [ 1370.819436][T26984] netlink: 'syz.0.4899': attribute type 12 has an invalid length. [ 1370.827456][T26984] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4899'. [ 1371.005117][T26989] fuse: Bad value for 'fd' [ 1371.082774][T26995] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4903'. [ 1371.176098][T12480] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 1371.256045][ T5926] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1371.328039][T12480] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1371.352671][T12480] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1371.371964][T12480] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1371.388405][T12480] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1371.410066][T12480] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1371.426964][ T5926] usb 1-1: Using ep0 maxpacket: 8 [ 1371.447727][ T5926] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1371.456973][ T5926] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1371.478951][T12480] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1371.488368][T12480] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1371.498410][ T5926] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1371.509028][T12480] usb 4-1: Product: syz [ 1371.513238][T12480] usb 4-1: Manufacturer: syz [ 1371.526011][ T5926] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1371.542334][ T5926] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1371.561741][T12480] cdc_wdm 4-1:1.0: skipping garbage [ 1371.578209][T12480] cdc_wdm 4-1:1.0: skipping garbage [ 1371.598807][ T5926] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1371.608403][T12480] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1371.620376][T12480] cdc_wdm 4-1:1.0: Unknown control protocol [ 1371.630918][ T5926] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1371.880966][ T5926] usb 1-1: GET_CAPABILITIES returned 0 [ 1371.901461][ T5926] usbtmc 1-1:16.0: can't read capabilities [ 1372.006005][ T5895] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1372.052106][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1372.058771][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1372.065973][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1372.072601][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1372.079465][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1372.086098][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1372.095096][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1372.101711][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1372.109327][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1372.115934][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1372.122445][ T5926] usb 4-1: USB disconnect, device number 108 [ 1372.128618][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1372.128634][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1372.128645][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1372.151886][T12480] usb 1-1: USB disconnect, device number 99 [ 1372.260112][ T5895] usb 2-1: Using ep0 maxpacket: 32 [ 1372.292985][T27040] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4909'. [ 1372.372597][ T5895] usb 2-1: config 0 has an invalid interface number: 184 but max is 11 [ 1372.412419][ T5895] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 12 [ 1372.527026][ T5895] usb 2-1: config 0 has no interface number 0 [ 1372.574565][ T5895] usb 2-1: config 0 interface 184 has no altsetting 0 [ 1372.593780][ T5895] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1372.614301][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1372.635670][ T5895] usb 2-1: Product: syz [ 1372.649843][ T5895] usb 2-1: Manufacturer: syz [ 1372.664852][ T5895] usb 2-1: SerialNumber: syz [ 1372.666626][T12480] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 1372.706845][ T5895] usb 2-1: config 0 descriptor?? [ 1372.740237][ T5895] smsc75xx v1.0.0 [ 1372.816091][T12480] usb 5-1: device descriptor read/64, error -71 [ 1373.076008][T12480] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 1373.246011][T12480] usb 5-1: device descriptor read/64, error -71 [ 1373.284319][T27058] pim6reg: entered allmulticast mode [ 1373.335246][ T5895] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1373.347103][ T5895] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1373.362369][ T5895] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 1373.374492][ T5895] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 1373.381244][T12480] usb usb5-port1: attempt power cycle [ 1373.415909][ T5895] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1373.436072][ T5895] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 1373.445847][ T5895] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -61 [ 1373.536438][ T2153] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1373.556194][T20219] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 1373.716307][T20219] usb 4-1: Using ep0 maxpacket: 8 [ 1373.721507][ T2153] usb 3-1: Using ep0 maxpacket: 16 [ 1373.736091][T12480] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 1373.737854][ T2153] usb 3-1: config 8 has an invalid interface number: 39 but max is 0 [ 1373.753336][ T2153] usb 3-1: config 8 has no interface number 0 [ 1373.762509][T20219] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1373.772337][ T2153] usb 3-1: config 8 interface 39 altsetting 1 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 1373.784183][ T5836] Bluetooth: hci0: command 0x0406 tx timeout [ 1373.787886][T12480] usb 5-1: device descriptor read/8, error -71 [ 1373.796831][T20219] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.804858][T20219] usb 4-1: Product: syz [ 1373.809839][ T2153] usb 3-1: config 8 interface 39 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1373.820984][T20219] usb 4-1: Manufacturer: syz [ 1373.825620][T20219] usb 4-1: SerialNumber: syz [ 1373.831348][ T2153] usb 3-1: config 8 interface 39 altsetting 1 bulk endpoint 0x8F has invalid maxpacket 0 [ 1373.844474][ T2153] usb 3-1: config 8 interface 39 has no altsetting 0 [ 1373.852187][T20219] usb 4-1: config 0 descriptor?? [ 1373.863661][T20219] gspca_main: se401-2.14.0 probing 047d:5003 [ 1373.872139][ T2153] usb 3-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 1373.884988][ T2153] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.895614][ T2153] usb 3-1: Product: syz [ 1373.903096][ T2153] usb 3-1: Manufacturer: syz [ 1373.910665][ T2153] usb 3-1: SerialNumber: syz [ 1374.046144][T12480] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 1374.266700][T12480] usb 5-1: device descriptor read/8, error -71 [ 1374.382246][T12480] usb usb5-port1: unable to enumerate USB device [ 1374.478542][ T2153] ipheth 3-1:8.39: ipheth_get_macaddr: usb_control_msg: -71 [ 1374.492999][ T2153] ipheth 3-1:8.39: probe with driver ipheth failed with error -71 [ 1374.522540][ T2153] usb 3-1: USB disconnect, device number 98 [ 1374.644224][ T5895] usb 2-1: USB disconnect, device number 117 [ 1375.048010][T20219] gspca_se401: read req failed req 0x06 error -19 [ 1375.074847][T20219] usb 4-1: USB disconnect, device number 109 [ 1375.426122][T20219] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 1375.628866][T20219] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1375.637714][T20219] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1375.803456][T20219] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1375.813266][T20219] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1375.825472][T20219] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1375.896550][T20219] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1375.905844][T20219] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1375.924026][T20219] usb 4-1: Product: syz [ 1375.932467][T20219] usb 4-1: Manufacturer: syz [ 1375.995066][T20219] cdc_wdm 4-1:1.0: skipping garbage [ 1376.004244][T20219] cdc_wdm 4-1:1.0: skipping garbage [ 1376.013565][T20219] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1376.021639][T20219] cdc_wdm 4-1:1.0: Unknown control protocol [ 1376.632477][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1376.639133][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1376.645721][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1376.652319][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1376.658704][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1376.665326][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1376.671572][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1376.678172][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1376.719436][ T5926] usb 4-1: USB disconnect, device number 110 [ 1376.725546][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1376.817015][T20219] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 1376.923117][T27176] binder: BINDER_SET_CONTEXT_MGR already set [ 1376.929327][T27176] binder: 27150:27176 ioctl 4018620d 200000000040 returned -16 [ 1377.010191][T27178] vivid-000: ================= START STATUS ================= [ 1377.026033][T27178] vivid-000: Test Pattern: 75% Colorbar [ 1377.042822][T20219] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1377.065702][T20219] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1377.104205][T27178] vivid-000: Fill Percentage of Frame: 100 [ 1377.121080][T27178] vivid-000: Horizontal Movement: No Movement [ 1377.140479][T20219] usb 5-1: Product: syz [ 1377.171980][T27178] vivid-000: Vertical Movement: No Movement [ 1377.185421][T27178] vivid-000: OSD Text Mode: All [ 1377.200766][T27178] vivid-000: Show Border: false [ 1377.207491][T20219] usb 5-1: Manufacturer: syz [ 1377.232747][T27178] vivid-000: Show Square: false [ 1377.253387][T27178] vivid-000: Sensor Flipped Horizontally: false [ 1377.267232][T20219] usb 5-1: SerialNumber: syz [ 1377.281047][T27178] vivid-000: Sensor Flipped Vertically: false [ 1377.316398][T27178] vivid-000: Insert SAV Code in Image: false [ 1377.339148][T20219] usb 5-1: config 0 descriptor?? [ 1377.377370][T27178] vivid-000: Insert EAV Code in Image: false [ 1377.384091][T27178] vivid-000: Insert Video Guard Band: false [ 1377.392889][T27178] vivid-000: Reduced Framerate: false [ 1377.401134][T27178] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 1377.419748][T27178] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 1377.526618][T27178] vivid-000: Enable Capture Cropping: true grabbed [ 1377.553684][T27178] vivid-000: Enable Capture Composing: true grabbed [ 1377.561966][T27178] vivid-000: Enable Capture Scaler: true grabbed [ 1377.590920][T27178] vivid-000: Timestamp Source: End of Frame [ 1377.601562][T20219] hso 5-1:0.0: Failed to find BULK IN ep [ 1377.607244][T27178] vivid-000: Colorspace: Rec. 709 [ 1377.607273][T27178] vivid-000: Transfer Function: Default [ 1377.630092][T20219] usb-storage 5-1:0.0: USB Mass Storage device detected [ 1377.651114][T27178] vivid-000: Y'CbCr Encoding: Default [ 1377.668494][T27178] vivid-000: HSV Encoding: Hue 0-179 [ 1377.683925][T27178] vivid-000: Quantization: Default [ 1377.698327][T27178] vivid-000: Apply Alpha To Red Only: false [ 1377.713820][T27178] vivid-000: Standard Aspect Ratio: 4x3 [ 1377.724773][T27178] vivid-000: DV Timings Signal Mode: Current DV Timings [ 1377.745945][T27178] vivid-000: DV Timings: 640x480p59 inactive [ 1377.752708][T27178] vivid-000: DV Timings Aspect Ratio: 4x3 [ 1377.767228][T27178] vivid-000: Maximum EDID Blocks: 2 [ 1377.782150][T27178] vivid-000: Limited RGB Range (16-235): true [ 1377.797327][T27178] vivid-000: Rx RGB Quantization Range: Automatic [ 1377.805567][T27178] vivid-000: Power Present: 0x00000001 [ 1377.810014][T27178] tpg source WxH: 1280x720 (R'G'B) [ 1377.811103][T27178] tpg field: 1 [ 1377.812237][T27178] tpg crop: (0,0)/64x64 [ 1377.813330][T27178] tpg compose: (0,0)/16x16 [ 1377.814432][T27178] tpg colorspace: 3 [ 1377.816732][T27178] tpg transfer function: 0/1 [ 1377.817837][T27178] tpg quantization: 0/1 [ 1377.827138][T27178] tpg RGB range: 0/1 [ 1377.828386][T27178] vivid-000: ================== END STATUS ================== [ 1378.331748][ T5926] usb 5-1: USB disconnect, device number 121 [ 1379.356306][ T2153] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 1379.531144][ T2153] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1379.636430][ T2153] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1379.666464][ T2153] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1379.717084][ T2153] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1379.735161][T27220] netlink: 'syz.4.4938': attribute type 1 has an invalid length. [ 1379.751556][ T2153] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1379.783768][ T2153] usb 4-1: config 0 descriptor?? [ 1379.824565][T27220] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4938'. [ 1379.881908][T27256] bond1 (unregistering): Released all slaves [ 1380.212914][ T2153] plantronics 0003:047F:FFFF.0042: No inputs registered, leaving [ 1380.351348][ T2153] plantronics 0003:047F:FFFF.0042: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 1380.356081][T27294] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4941'. [ 1380.568265][T27308] veth1_macvtap: left promiscuous mode [ 1380.576423][T27308] macsec0: entered promiscuous mode [ 1380.615329][T27308] veth1_macvtap: entered promiscuous mode [ 1380.646827][T27308] macsec0: left promiscuous mode [ 1380.704845][T27315] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4943'. [ 1380.777289][T12480] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1380.852625][ C1] plantronics 0003:047F:FFFF.0042: hid_field_extract() called with n (132) > 32! (syz-executor) [ 1380.866869][T27318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1380.875522][T27318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1381.187504][T12480] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1381.266257][T12480] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1381.282252][T12480] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1381.295402][T12480] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1381.331949][T12480] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1381.369317][T12480] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1381.415931][T12480] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1381.423966][T12480] usb 1-1: Product: syz [ 1381.465990][T12480] usb 1-1: Manufacturer: syz [ 1381.497026][T12480] cdc_wdm 1-1:1.0: skipping garbage [ 1381.502360][T12480] cdc_wdm 1-1:1.0: skipping garbage [ 1381.559567][T12480] cdc_wdm 1-1:1.0: cdc-wdm1: USB WDM device [ 1381.565502][T12480] cdc_wdm 1-1:1.0: Unknown control protocol [ 1381.836888][T27352] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4947'. [ 1381.852495][T27352] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4947'. [ 1381.894860][T27352] 8021q: adding VLAN 0 to HW filter on device team1 [ 1382.152121][ T1225] usb 1-1: USB disconnect, device number 100 [ 1382.241833][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807defa000: rx timeout, send abort [ 1382.347303][ T5926] hid-generic 0000:0000:0000.0043: unknown main item tag 0x0 [ 1382.373438][ T5926] hid-generic 0000:0000:0000.0043: hidraw1: HID v0.00 Device [syz1] on syz0 [ 1382.607278][ T5895] usb 4-1: USB disconnect, device number 111 [ 1382.680346][T27409] vivid-000: ================= START STATUS ================= [ 1382.716460][T27409] vivid-000: Test Pattern: 75% Colorbar [ 1382.729981][T27409] vivid-000: Fill Percentage of Frame: 100 [ 1382.750067][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807defa000: abort rx timeout. Force session deactivation [ 1382.776664][T27409] vivid-000: Horizontal Movement: No Movement [ 1382.822634][T27409] vivid-000: Vertical Movement: No Movement [ 1382.863572][T27409] vivid-000: OSD Text Mode: All [ 1382.869634][T27409] vivid-000: Show Border: false [ 1382.879691][T27409] vivid-000: Show Square: false [ 1382.890521][T27409] vivid-000: Sensor Flipped Horizontally: false [ 1382.900703][T27409] vivid-000: Sensor Flipped Vertically: false [ 1382.909534][T27409] vivid-000: Insert SAV Code in Image: false [ 1382.921044][T27409] vivid-000: Insert EAV Code in Image: false [ 1382.931644][T27409] vivid-000: Insert Video Guard Band: false [ 1382.942262][T27409] vivid-000: Reduced Framerate: false [ 1382.954530][T27409] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 1382.975769][T27409] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 1382.989439][T27409] vivid-000: Enable Capture Cropping: true grabbed [ 1383.007583][T27409] vivid-000: Enable Capture Composing: true grabbed [ 1383.025465][T27409] vivid-000: Enable Capture Scaler: true grabbed [ 1383.083934][T27409] vivid-000: Timestamp Source: End of Frame [ 1383.103156][T27409] vivid-000: Colorspace: Rec. 709 [ 1383.115632][T27409] vivid-000: Transfer Function: Default [ 1383.132617][T27409] vivid-000: Y'CbCr Encoding: Default [ 1383.159747][T27409] vivid-000: HSV Encoding: Hue 0-179 [ 1383.174347][T27409] vivid-000: Quantization: Default [ 1383.188166][T27409] vivid-000: Apply Alpha To Red Only: false [ 1383.198677][T27409] vivid-000: Standard Aspect Ratio: 4x3 [ 1383.208971][T27409] vivid-000: DV Timings Signal Mode: Current DV Timings [ 1383.221266][T27409] vivid-000: DV Timings: 640x480p59 inactive [ 1383.231776][T27409] vivid-000: DV Timings Aspect Ratio: 4x3 [ 1383.243706][T27409] vivid-000: Maximum EDID Blocks: 2 [ 1383.260322][T27409] vivid-000: Limited RGB Range (16-235): true [ 1383.275017][T27409] vivid-000: Rx RGB Quantization Range: Automatic [ 1383.283546][T27409] vivid-000: Power Present: 0x00000001 [ 1383.295651][T27409] tpg source WxH: 1280x720 (R'G'B) [ 1383.301800][T27409] tpg field: 1 [ 1383.307005][T27409] tpg crop: (0,0)/64x64 [ 1383.312601][T27409] tpg compose: (0,0)/16x16 [ 1383.321823][T27409] tpg colorspace: 3 [ 1383.327231][T27409] tpg transfer function: 0/1 [ 1383.332813][T27409] tpg quantization: 0/1 [ 1383.339578][T27409] tpg RGB range: 0/1 [ 1383.345098][T27409] vivid-000: ================== END STATUS ================== [ 1383.496197][ T5895] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 1383.655973][ T5895] usb 2-1: Using ep0 maxpacket: 16 [ 1384.101173][ T5895] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 1384.114145][ T5895] usb 2-1: config 0 has no interface number 0 [ 1384.130943][ T5895] usb 2-1: too many endpoints for config 0 interface 1 altsetting 89: 172, using maximum allowed: 30 [ 1384.144721][ T5895] usb 2-1: config 0 interface 1 altsetting 89 has 0 endpoint descriptors, different from the interface descriptor's value: 172 [ 1384.165464][ T5895] usb 2-1: config 0 interface 1 has no altsetting 0 [ 1384.191325][ T5895] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1384.206219][ T5895] usb 2-1: New USB device strings: Mfr=3, Product=2, SerialNumber=3 [ 1384.243084][ T5895] usb 2-1: Product: syz [ 1384.271079][ T5895] usb 2-1: Manufacturer: syz [ 1384.296099][ T5895] usb 2-1: SerialNumber: syz [ 1384.331980][ T5895] usb 2-1: config 0 descriptor?? [ 1384.786086][T20219] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 1384.949069][T20219] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1384.958643][T20219] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1384.985308][T20219] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1385.003204][T20219] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1385.031495][T20219] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1385.064926][T20219] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1385.074693][T20219] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1385.083170][T20219] usb 5-1: Product: syz [ 1385.087966][T20219] usb 5-1: Manufacturer: syz [ 1385.122044][T27466] netlink: 'syz.0.4960': attribute type 1 has an invalid length. [ 1385.123570][T20219] cdc_wdm 5-1:1.0: skipping garbage [ 1385.148002][T20219] cdc_wdm 5-1:1.0: skipping garbage [ 1385.174699][T20219] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1385.204767][T27478] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4960'. [ 1385.218486][T20219] cdc_wdm 5-1:1.0: Unknown control protocol [ 1385.353159][T27491] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1385.714820][ C1] wdm_int_callback: 190 callbacks suppressed [ 1385.714845][ C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 1385.716519][ T1225] usb 5-1: USB disconnect, device number 122 [ 1385.720867][ C1] wdm_int_callback: 190 callbacks suppressed [ 1385.720903][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 1385.745523][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1385.809416][ T5895] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1385.826460][ T5895] gspca_spca1528: reg_w err -71 [ 1385.851780][ T5895] spca1528 2-1:0.1: probe with driver spca1528 failed with error -71 [ 1385.875064][ T5895] usb 2-1: USB disconnect, device number 118 [ 1386.066518][T27466] bond5 (unregistering): Released all slaves [ 1386.891532][T27570] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1387.595998][T12480] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1387.719405][T27592] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4969'. [ 1387.765983][T12480] usb 2-1: Using ep0 maxpacket: 32 [ 1387.793121][T12480] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 1387.827442][T12480] usb 2-1: config 0 has no interface number 0 [ 1387.846740][T12480] usb 2-1: config 0 interface 67 altsetting 0 endpoint 0x82 has invalid maxpacket 21760, setting to 1024 [ 1387.876457][T12480] usb 2-1: config 0 interface 67 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1387.896807][T12480] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1387.919332][T12480] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1387.934479][T12480] usb 2-1: Product: syz [ 1387.939976][T12480] usb 2-1: Manufacturer: syz [ 1387.945806][T12480] usb 2-1: SerialNumber: syz [ 1387.977508][T12480] usb 2-1: config 0 descriptor?? [ 1388.000007][T27582] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1388.021871][T12480] smsc95xx v2.0.0 [ 1388.130741][T27608] netlink: 'syz.0.4972': attribute type 1 has an invalid length. [ 1388.173241][T27608] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4972'. [ 1388.184274][T27608] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1388.226720][ T1225] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1388.244235][T27582] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1388.421126][ T1225] usb 3-1: too many configurations: 33, using maximum allowed: 8 [ 1388.446402][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1388.455068][ T1225] usb 3-1: config 0 has no interface number 0 [ 1388.461469][T12480] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -61 [ 1388.473026][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1388.509422][T12480] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1388.519970][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1388.550404][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1388.568716][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1388.580968][ T1225] usb 3-1: config 0 has no interface number 0 [ 1388.602147][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1388.636909][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1388.662853][T12480] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1388.691927][T12480] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 1388.707117][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1388.737186][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1388.749740][ T1225] usb 3-1: config 0 has no interface number 0 [ 1388.757871][T12480] usb 2-1: USB disconnect, device number 119 [ 1388.786985][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1388.836684][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1388.880113][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1388.897739][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1388.910533][ T1225] usb 3-1: config 0 has no interface number 0 [ 1388.926027][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1388.966312][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1388.997013][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1389.022287][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1389.040828][ T1225] usb 3-1: config 0 has no interface number 0 [ 1389.063333][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1389.125962][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1389.141446][T27608] bond5 (unregistering): Released all slaves [ 1389.186022][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1389.230353][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1389.266208][ T1225] usb 3-1: config 0 has no interface number 0 [ 1389.283153][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1389.322019][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1389.376535][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1389.400144][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1389.416845][ T1225] usb 3-1: config 0 has no interface number 0 [ 1389.425208][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1389.442906][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1389.525144][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1389.529967][T27684] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4974'. [ 1389.536209][ T1225] usb 3-1: config 0 has an invalid interface number: 38 but max is 0 [ 1389.549482][ T1225] usb 3-1: config 0 has no interface number 0 [ 1389.564872][ T1225] usb 3-1: too many endpoints for config 0 interface 38 altsetting 175: 138, using maximum allowed: 30 [ 1389.595593][ T1225] usb 3-1: config 0 interface 38 altsetting 175 has 0 endpoint descriptors, different from the interface descriptor's value: 138 [ 1389.614343][ T1225] usb 3-1: config 0 interface 38 has no altsetting 0 [ 1389.634665][ T1225] usb 3-1: New USB device found, idVendor=0eb1, idProduct=6668, bcdDevice=57.b8 [ 1389.646597][T27694] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1389.676619][ T1225] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.684662][ T1225] usb 3-1: Product: syz [ 1389.758512][ T1225] usb 3-1: Manufacturer: syz [ 1389.767817][ T1225] usb 3-1: SerialNumber: syz [ 1389.782632][ T1225] usb 3-1: config 0 descriptor?? [ 1390.386010][T12480] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 1390.537915][T12480] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1390.556099][T12480] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1390.576012][T12480] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1390.600111][T12480] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1390.638890][ T1225] go7007-loader 3-1:0.38: can't handle multiple config [ 1390.761403][T12480] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1390.775574][ T1225] go7007-loader 3-1:0.38: probe failed [ 1390.786472][ T1225] usb 3-1: USB disconnect, device number 100 [ 1390.808254][T12480] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1390.880680][T12480] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1390.915998][T12480] usb 4-1: Product: syz [ 1390.932072][T12480] usb 4-1: Manufacturer: syz [ 1390.982278][T12480] cdc_wdm 4-1:1.0: skipping garbage [ 1391.019056][T12480] cdc_wdm 4-1:1.0: skipping garbage [ 1391.053524][T12480] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1391.085950][T12480] cdc_wdm 4-1:1.0: Unknown control protocol [ 1391.456009][T12480] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 1391.520911][T27750] netlink: 'syz.4.4986': attribute type 1 has an invalid length. [ 1391.635962][T12480] usb 2-1: Using ep0 maxpacket: 16 [ 1391.641915][T27760] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4986'. [ 1391.662553][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1391.663022][ T5895] usb 4-1: USB disconnect, device number 112 [ 1391.669168][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1391.669207][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1391.707137][T12480] usb 2-1: config 0 has no interfaces? [ 1391.712628][T12480] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1391.844296][T27771] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1391.851369][T12480] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.862987][T12480] usb 2-1: config 0 descriptor?? [ 1392.105527][T27739] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1392.151796][T27739] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1392.175044][T12480] usb 2-1: USB disconnect, device number 120 [ 1392.457836][T27750] bond1 (unregistering): Released all slaves [ 1392.666454][T12480] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 1392.959519][T12480] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1392.980942][T12480] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1393.031805][T12480] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1393.060520][T12480] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1393.077666][T12480] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1393.116136][T27863] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4993'. [ 1393.138146][T12480] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1393.146233][T12480] usb 1-1: invalid MIDI out EP 0 [ 1393.342096][T27818] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1393.351169][T27818] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1393.362420][T27818] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1393.371689][T27818] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1393.481742][T27888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1393.716390][T12480] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1393.920004][ T5991] usb 1-1: USB disconnect, device number 101 [ 1394.080163][T20219] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 1394.148666][T27927] Cannot find set identified by id 0 to match [ 1394.366993][T20219] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1394.394549][T20219] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1394.436733][ T5895] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 1394.490392][T20219] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1394.510289][T20219] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1394.532509][T20219] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1394.563554][T20219] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1394.573402][T20219] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1394.585352][T20219] usb 4-1: Product: syz [ 1394.601236][T20219] usb 4-1: Manufacturer: syz [ 1394.666996][ T5895] usb 2-1: Using ep0 maxpacket: 16 [ 1394.706663][T20219] cdc_wdm 4-1:1.0: skipping garbage [ 1394.765845][T20219] cdc_wdm 4-1:1.0: skipping garbage [ 1394.838974][T20219] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1394.850862][T20219] cdc_wdm 4-1:1.0: Unknown control protocol [ 1395.009468][T27947] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5002'. [ 1395.454555][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1395.461205][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1395.467702][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1395.469699][ T1225] usb 4-1: USB disconnect, device number 113 [ 1395.474325][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1395.486418][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1395.661424][T27947] veth1_vlan (unregistering): left allmulticast mode [ 1395.987739][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 1395.987758][ T30] audit: type=1326 audit(1750898443.663:2348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5f4338e929 code=0x7ffc0000 [ 1396.069329][ T30] audit: type=1326 audit(1750898443.663:2349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5f4338e929 code=0x7ffc0000 [ 1396.092631][ T30] audit: type=1326 audit(1750898443.663:2350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=427 compat=0 ip=0x7f5f4338e929 code=0x7ffc0000 [ 1396.122834][ T30] audit: type=1326 audit(1750898443.663:2351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5f4338e929 code=0x7ffc0000 [ 1396.187257][T20219] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1396.230620][ T30] audit: type=1326 audit(1750898443.663:2352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5f4338e929 code=0x7ffc0000 [ 1396.253198][ T2153] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 1396.293378][ T30] audit: type=1326 audit(1750898443.663:2353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5f4338d290 code=0x7ffc0000 [ 1396.354075][ T30] audit: type=1326 audit(1750898443.663:2354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5f4338e52b code=0x7ffc0000 [ 1396.402301][ T30] audit: type=1326 audit(1750898443.663:2355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5f4338e52b code=0x7ffc0000 [ 1396.425430][T20219] usb 1-1: Using ep0 maxpacket: 32 [ 1396.433050][T20219] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1396.440911][ T30] audit: type=1326 audit(1750898443.693:2356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5f4338e52b code=0x7ffc0000 [ 1396.464218][ T2153] usb 4-1: Using ep0 maxpacket: 16 [ 1396.474340][T20219] usb 1-1: config 7 has an invalid interface number: 128 but max is 0 [ 1396.482694][ T2153] usb 4-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1396.497815][T20219] usb 1-1: config 7 contains an unexpected descriptor of type 0x1, skipping [ 1396.507583][ T2153] usb 4-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1396.518021][T20219] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 1396.538186][ T2153] usb 4-1: config 7 interface 0 altsetting 5 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1396.548408][ T30] audit: type=1326 audit(1750898443.693:2357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27978 comm="syz.3.5004" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5f4338e52b code=0x7ffc0000 [ 1396.571228][T20219] usb 1-1: config 7 has no interface number 0 [ 1396.578656][ T2153] usb 4-1: config 7 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1396.592002][T20219] usb 1-1: config 7 interface 128 altsetting 2 has an endpoint descriptor with address 0x17, changing to 0x7 [ 1396.604013][ T2153] usb 4-1: config 7 interface 0 has no altsetting 0 [ 1396.611195][T20219] usb 1-1: config 7 interface 128 altsetting 2 bulk endpoint 0x7 has invalid maxpacket 32 [ 1396.626021][ T2153] usb 4-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 1396.635541][T20219] usb 1-1: config 7 interface 128 altsetting 2 endpoint 0x87 has an invalid bInterval 209, changing to 11 [ 1396.656628][ T2153] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1396.664855][T20219] usb 1-1: config 7 interface 128 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 1396.722376][T20219] usb 1-1: config 7 interface 128 has no altsetting 0 [ 1396.748262][T20219] usb 1-1: New USB device found, idVendor=6033, idProduct=4108, bcdDevice=cc.13 [ 1396.759114][T20219] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1396.767736][T20219] usb 1-1: Product: syz [ 1396.778951][T20219] usb 1-1: Manufacturer: syz [ 1396.783815][T20219] usb 1-1: SerialNumber: syz [ 1396.815015][T27968] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1397.045546][T20219] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1397.074291][T20219] usb 1-1: MIDIStreaming interface descriptor not found [ 1397.114273][ T2153] input: HID 0458:5010 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:7.0/0003:0458:5010.0044/input/input104 [ 1397.262493][T20219] usb 1-1: USB disconnect, device number 102 [ 1397.441516][ T2153] kye 0003:0458:5010.0044: input,hiddev0,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.3-1/input0 [ 1397.501051][ T2153] usb 4-1: USB disconnect, device number 114 [ 1397.694949][T28022] fido_id[28022]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 1397.804090][ T5895] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1397.836848][ T5895] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1397.885939][ T5895] usb 2-1: can't read configurations, error -71 [ 1398.196792][T28082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1398.236133][T28082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1398.451963][T28100] FAULT_INJECTION: forcing a failure. [ 1398.451963][T28100] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1398.490925][T28100] CPU: 0 UID: 0 PID: 28100 Comm: syz.2.5017 Not tainted 6.16.0-rc3-syzkaller-00057-g92ca6c498a5e #0 PREEMPT(full) [ 1398.490953][T28100] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1398.490966][T28100] Call Trace: [ 1398.490975][T28100] [ 1398.490984][T28100] dump_stack_lvl+0x189/0x250 [ 1398.491021][T28100] ? __pfx____ratelimit+0x10/0x10 [ 1398.491051][T28100] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1398.491083][T28100] ? __pfx__printk+0x10/0x10 [ 1398.491105][T28100] ? __might_fault+0xb0/0x130 [ 1398.491144][T28100] should_fail_ex+0x414/0x560 [ 1398.491175][T28100] _copy_from_iter+0x1db/0x16f0 [ 1398.491210][T28100] ? rcu_is_watching+0x15/0xb0 [ 1398.491242][T28100] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 1398.491265][T28100] ? __pfx__copy_from_iter+0x10/0x10 [ 1398.491295][T28100] ? __build_skb_around+0x257/0x3e0 [ 1398.491322][T28100] ? netlink_sendmsg+0x642/0xb30 [ 1398.491344][T28100] ? skb_put+0x11b/0x210 [ 1398.491370][T28100] netlink_sendmsg+0x6b2/0xb30 [ 1398.491403][T28100] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1398.491429][T28100] ? aa_sock_msg_perm+0x94/0x160 [ 1398.491456][T28100] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1398.491481][T28100] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1398.491506][T28100] __sock_sendmsg+0x219/0x270 [ 1398.491539][T28100] ____sys_sendmsg+0x52d/0x830 [ 1398.491570][T28100] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1398.491604][T28100] ? import_iovec+0x74/0xa0 [ 1398.491630][T28100] ___sys_sendmsg+0x21f/0x2a0 [ 1398.491658][T28100] ? __pfx____sys_sendmsg+0x10/0x10 [ 1398.491733][T28100] ? __fget_files+0x2a/0x420 [ 1398.491752][T28100] ? __fget_files+0x3a0/0x420 [ 1398.491784][T28100] __sys_sendmmsg+0x227/0x430 [ 1398.491812][T28100] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1398.491834][T28100] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1398.491889][T28100] ? ksys_write+0x22a/0x250 [ 1398.491909][T28100] ? __pfx_ksys_write+0x10/0x10 [ 1398.491933][T28100] __x64_sys_sendmmsg+0xa0/0xc0 [ 1398.491959][T28100] do_syscall_64+0xfa/0x3b0 [ 1398.491975][T28100] ? lockdep_hardirqs_on+0x9c/0x150 [ 1398.492001][T28100] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.492020][T28100] ? clear_bhb_loop+0x60/0xb0 [ 1398.492043][T28100] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.492062][T28100] RIP: 0033:0x7f89bef8e929 [ 1398.492079][T28100] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1398.492097][T28100] RSP: 002b:00007f89bcdf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1398.492116][T28100] RAX: ffffffffffffffda RBX: 00007f89bf1b5fa0 RCX: 00007f89bef8e929 [ 1398.492137][T28100] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 1398.492150][T28100] RBP: 00007f89bcdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1398.492162][T28100] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1398.492173][T28100] R13: 0000000000000000 R14: 00007f89bf1b5fa0 R15: 00007f89bf2dfa28 [ 1398.492202][T28100] [ 1398.811455][T28105] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1398.888572][ T5895] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 1398.973688][T28112] Cannot find set identified by id 0 to match [ 1399.154586][ T5895] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1399.167030][ T5895] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1399.183450][ T5895] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1399.193668][ T5895] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1399.205159][ T5895] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1399.219475][ T5895] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1399.229754][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1399.240911][ T5895] usb 2-1: Product: syz [ 1399.247461][ T5895] usb 2-1: Manufacturer: syz [ 1399.349595][ T5895] cdc_wdm 2-1:1.0: skipping garbage [ 1399.354853][ T5895] cdc_wdm 2-1:1.0: skipping garbage [ 1399.393209][ T5895] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1399.599232][ T5895] cdc_wdm 2-1:1.0: Unknown control protocol [ 1399.748527][T28136] vivid-000: ================= START STATUS ================= [ 1399.785949][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.792782][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.799044][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.805636][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.811868][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.818468][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.824725][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.831309][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.837619][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.844321][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.850601][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.857190][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.863935][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.870530][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.876878][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.883479][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.890193][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.896880][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.903201][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1399.909794][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1399.928972][ T5895] usb 2-1: USB disconnect, device number 122 [ 1399.935061][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1399.974705][T28136] vivid-000: Test Pattern: 75% Colorbar [ 1400.007436][T28136] vivid-000: Fill Percentage of Frame: 100 [ 1400.020651][T28136] vivid-000: Horizontal Movement: Move Left Slow [ 1400.054558][T12480] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1400.116409][T12480] hid-generic 0000:0000:0000.0045: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1400.131968][T28136] vivid-000: Vertical Movement: No Movement [ 1400.235979][T28136] vivid-000: OSD Text Mode: All [ 1400.335010][T28136] vivid-000: Show Border: false [ 1400.415037][T28136] vivid-000: Show Square: false [ 1400.420468][T28136] vivid-000: Sensor Flipped Horizontally: false [ 1400.430327][T28136] vivid-000: Sensor Flipped Vertically: false [ 1400.930016][T28136] vivid-000: Insert SAV Code in Image: false [ 1400.952507][T28136] vivid-000: Insert EAV Code in Image: false [ 1401.049073][T28136] vivid-000: Insert Video Guard Band: false [ 1401.059995][T28136] vivid-000: Reduced Framerate: false [ 1401.071899][T28136] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 1401.084198][T28136] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 1401.098167][T28136] vivid-000: Enable Capture Cropping: true grabbed [ 1401.111486][T28136] vivid-000: Enable Capture Composing: true grabbed [ 1401.124945][T28136] vivid-000: Enable Capture Scaler: true grabbed [ 1401.137395][T28136] vivid-000: Timestamp Source: End of Frame [ 1401.150323][T28136] vivid-000: Colorspace: Rec. 709 [ 1401.160050][T28136] vivid-000: Transfer Function: Default [ 1401.174706][T28136] vivid-000: Y'CbCr Encoding: Default [ 1401.186913][T28136] vivid-000: HSV Encoding: Hue 0-179 [ 1401.195978][T28136] vivid-000: Quantization: Default [ 1401.206559][T28136] vivid-000: Apply Alpha To Red Only: false [ 1401.212549][T28136] vivid-000: Standard Aspect Ratio: 4x3 [ 1401.218729][T28136] vivid-000: DV Timings Signal Mode: Current DV Timings [ 1401.226714][T28136] vivid-000: DV Timings: 640x480p59 inactive [ 1401.232809][T28136] vivid-000: DV Timings Aspect Ratio: 4x3 [ 1401.238646][T28136] vivid-000: Maximum EDID Blocks: 2 [ 1401.243888][T28136] vivid-000: Limited RGB Range (16-235): true [ 1401.250074][T28136] vivid-000: Rx RGB Quantization Range: Automatic [ 1401.256725][T28136] vivid-000: Power Present: 0x00000001 [ 1401.262291][T28136] tpg source WxH: 1280x720 (Y'CbCr) [ 1401.267602][T28136] tpg field: 1 [ 1401.272401][T28136] tpg crop: (0,0)/64x64 [ 1401.276885][T28136] tpg compose: (0,0)/16x16 [ 1401.281339][T28136] tpg colorspace: 3 [ 1401.285244][T28136] tpg transfer function: 0/1 [ 1401.306225][T28136] tpg Y'CbCr encoding: 0/2 [ 1401.311811][T28136] tpg quantization: 0/2 [ 1401.317701][T28136] tpg RGB range: 0/1 [ 1401.322205][T28136] vivid-000: ================== END STATUS ================== [ 1401.524668][T28160] SET target dimension over the limit! [ 1401.591409][T28164] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5027'. [ 1401.636264][T28173] netlink: 84 bytes leftover after parsing attributes in process `syz.4.5028'. [ 1401.846440][ T1225] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 1401.996052][ T1225] usb 2-1: Using ep0 maxpacket: 8 [ 1402.002968][ T1225] usb 2-1: config 0 has an invalid interface number: 148 but max is 0 [ 1402.012744][ T1225] usb 2-1: config 0 has no interface number 0 [ 1402.022736][ T1225] usb 2-1: New USB device found, idVendor=0d46, idProduct=2012, bcdDevice=4d.36 [ 1402.032315][ T1225] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1402.040997][ T1225] usb 2-1: Product: syz [ 1402.045456][ T1225] usb 2-1: Manufacturer: syz [ 1402.057108][ T1225] usb 2-1: SerialNumber: syz [ 1402.078028][ T1225] usb 2-1: config 0 descriptor?? [ 1402.106601][ T1225] kobil_sct 2-1:0.148: KOBIL USB smart card terminal converter detected [ 1402.129361][ T1225] usb 2-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1402.314384][ T1225] usb 2-1: USB disconnect, device number 123 [ 1402.429678][T28191] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5031'. [ 1402.479821][ T1225] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1402.555771][T28191] 8021q: adding VLAN 0 to HW filter on device team2 [ 1402.610105][ T1225] kobil_sct 2-1:0.148: device disconnected [ 1403.009406][T28244] FAULT_INJECTION: forcing a failure. [ 1403.009406][T28244] name failslab, interval 1, probability 0, space 0, times 0 [ 1403.024546][T28247] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5033'. [ 1403.033946][T28244] CPU: 1 UID: 0 PID: 28244 Comm: syz.4.5035 Not tainted 6.16.0-rc3-syzkaller-00057-g92ca6c498a5e #0 PREEMPT(full) [ 1403.033973][T28244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1403.033986][T28244] Call Trace: [ 1403.033995][T28244] [ 1403.034004][T28244] dump_stack_lvl+0x189/0x250 [ 1403.034040][T28244] ? __pfx____ratelimit+0x10/0x10 [ 1403.034070][T28244] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1403.034100][T28244] ? __pfx__printk+0x10/0x10 [ 1403.034129][T28244] ? ref_tracker_alloc+0x318/0x460 [ 1403.034175][T28244] should_fail_ex+0x414/0x560 [ 1403.034205][T28244] should_failslab+0xa8/0x100 [ 1403.034229][T28244] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1403.034278][T28244] ? skb_clone+0x212/0x3a0 [ 1403.034310][T28244] skb_clone+0x212/0x3a0 [ 1403.034342][T28244] __netlink_deliver_tap+0x404/0x850 [ 1403.034379][T28244] ? netlink_deliver_tap+0x2e/0x1b0 [ 1403.034405][T28244] netlink_deliver_tap+0x19c/0x1b0 [ 1403.034430][T28244] netlink_unicast+0x72f/0x8d0 [ 1403.034463][T28244] netlink_sendmsg+0x805/0xb30 [ 1403.034498][T28244] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1403.034525][T28244] ? aa_sock_msg_perm+0x94/0x160 [ 1403.034554][T28244] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1403.034580][T28244] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1403.034606][T28244] __sock_sendmsg+0x219/0x270 [ 1403.034652][T28244] ____sys_sendmsg+0x505/0x830 [ 1403.034683][T28244] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1403.034729][T28244] ? import_iovec+0x74/0xa0 [ 1403.034751][T28244] ___sys_sendmsg+0x21f/0x2a0 [ 1403.034792][T28244] ? __pfx____sys_sendmsg+0x10/0x10 [ 1403.034847][T28244] ? __fget_files+0x2a/0x420 [ 1403.034872][T28244] ? __fget_files+0x3a0/0x420 [ 1403.034899][T28244] __x64_sys_sendmsg+0x19b/0x260 [ 1403.034923][T28244] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1403.034953][T28244] ? __pfx_ksys_write+0x10/0x10 [ 1403.034967][T28244] ? rcu_is_watching+0x15/0xb0 [ 1403.034998][T28244] ? do_syscall_64+0xbe/0x3b0 [ 1403.035018][T28244] do_syscall_64+0xfa/0x3b0 [ 1403.035033][T28244] ? lockdep_hardirqs_on+0x9c/0x150 [ 1403.035057][T28244] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.035075][T28244] ? clear_bhb_loop+0x60/0xb0 [ 1403.035095][T28244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.035113][T28244] RIP: 0033:0x7fac2578e929 [ 1403.035128][T28244] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1403.035143][T28244] RSP: 002b:00007fac2669f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1403.035162][T28244] RAX: ffffffffffffffda RBX: 00007fac259b5fa0 RCX: 00007fac2578e929 [ 1403.035176][T28244] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000004 [ 1403.035186][T28244] RBP: 00007fac2669f090 R08: 0000000000000000 R09: 0000000000000000 [ 1403.035197][T28244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1403.035208][T28244] R13: 0000000000000000 R14: 00007fac259b5fa0 R15: 00007fac25adfa28 [ 1403.035236][T28244] [ 1403.635917][ T2153] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 1403.649956][T28261] Cannot find set identified by id 0 to match [ 1403.797819][ T2153] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1403.870972][ T2153] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1403.929052][ T2153] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1403.969806][ T2153] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1404.030278][ T2153] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1404.139538][ T2153] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1404.149091][T12480] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 1404.305939][T12480] usb 4-1: Using ep0 maxpacket: 8 [ 1404.315270][ T2153] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1404.317340][T12480] usb 4-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 16 [ 1404.327306][T28277] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5042'. [ 1404.334009][T12480] usb 4-1: config 1 interface 0 altsetting 4 bulk endpoint 0x3 has invalid maxpacket 32 [ 1404.357242][T12480] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1404.368176][ T2153] usb 1-1: Product: syz [ 1404.372443][ T2153] usb 1-1: Manufacturer: syz [ 1404.407619][ T2153] cdc_wdm 1-1:1.0: skipping garbage [ 1404.428593][ T2153] cdc_wdm 1-1:1.0: skipping garbage [ 1404.442982][T12480] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1404.443075][ T2153] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1404.481778][ T2153] cdc_wdm 1-1:1.0: Unknown control protocol [ 1404.481835][T12480] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1404.517509][T12480] usb 4-1: Product: syz [ 1404.532185][T12480] usb 4-1: Manufacturer: syz [ 1404.567641][T12480] usb 4-1: SerialNumber: syz [ 1404.605524][T28267] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1404.618438][T28267] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1404.847668][T28267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1404.891531][T28267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1404.947758][T28267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1404.967949][ T2153] usb 2-1: new full-speed USB device number 124 using dummy_hcd [ 1404.986502][T28267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1405.090049][T28267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1405.166380][T28267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1405.181975][T28267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1405.190905][ T2153] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1405.591095][ T2153] usb 2-1: not running at top speed; connect to a high speed hub [ 1405.630097][ T2153] usb 2-1: config 12 has an invalid interface number: 173 but max is 1 [ 1405.666572][ C0] wdm_int_callback: 74 callbacks suppressed [ 1405.666595][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.679202][ C0] wdm_int_callback: 74 callbacks suppressed [ 1405.679221][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.691568][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.698195][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.704558][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.711182][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.717470][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.724084][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.730766][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.737387][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.743756][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.750378][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.756648][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.763251][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.769622][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.776231][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.785948][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.792583][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.800809][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1405.807438][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1405.815937][ T2153] usb 2-1: config 12 has an invalid interface number: 173 but max is 1 [ 1405.825682][T28267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1405.918742][T28267] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1405.921937][ T2153] usb 2-1: config 12 has 1 interface, different from the descriptor's value: 2 [ 1405.946696][ T5895] usb 1-1: USB disconnect, device number 103 [ 1405.946821][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1406.005075][T28267] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1406.295204][ T2153] usb 2-1: config 12 has no interface number 0 [ 1406.306064][ T2153] usb 2-1: config 12 interface 173 has no altsetting 0 [ 1406.312964][ T2153] usb 2-1: config 12 interface 173 has no altsetting 1 [ 1406.330260][ T2153] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice=33.b7 [ 1406.339768][ T2153] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1406.348038][ T2153] usb 2-1: Product: syz [ 1406.352251][ T2153] usb 2-1: Manufacturer: syz [ 1406.357070][ T2153] usb 2-1: SerialNumber: syz [ 1406.656998][ T2153] usb 2-1: USB disconnect, device number 124 [ 1406.688825][T12480] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 1406.750066][T12480] usb 4-1: USB disconnect, device number 115 [ 1407.392598][T28348] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5049'. [ 1407.696491][ T5895] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 1407.900946][ T5895] usb 2-1: device descriptor read/64, error -71 [ 1408.166051][ T5895] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 1408.346483][ T5895] usb 2-1: device descriptor read/64, error -71 [ 1408.497170][ T2153] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1408.505169][ T5895] usb usb2-port1: attempt power cycle [ 1408.656738][ T2153] usb 1-1: Using ep0 maxpacket: 8 [ 1408.682977][ T2153] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1408.706388][ T2153] usb 1-1: config 0 has no interfaces? [ 1408.711960][ T2153] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1408.721236][ T2153] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1408.736976][ T2153] usb 1-1: config 0 descriptor?? [ 1408.866053][ T5895] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 1408.919394][ T5895] usb 2-1: device descriptor read/8, error -71 [ 1408.952081][T28376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1409.001051][T28376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1409.053456][T28376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1409.116388][T28376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1409.138942][ T5903] usb 1-1: USB disconnect, device number 104 [ 1409.208930][ T5895] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1409.248056][ T5895] usb 2-1: device descriptor read/8, error -71 [ 1409.305803][T18493] hid-generic 0000:0000:0000.0046: unknown main item tag 0x0 [ 1409.344778][T18493] hid-generic 0000:0000:0000.0046: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1409.368961][ T2153] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 1409.386607][ T5895] usb usb2-port1: unable to enumerate USB device [ 1409.587286][ T2153] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1409.616411][ T2153] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1409.654438][ T2153] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1409.677885][ T2153] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1409.696052][ T2153] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1409.727658][ T2153] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1409.751174][ T2153] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1409.759632][ T2153] usb 5-1: Product: syz [ 1409.763827][ T2153] usb 5-1: Manufacturer: syz [ 1409.784354][ T2153] cdc_wdm 5-1:1.0: skipping garbage [ 1409.795952][ T2153] cdc_wdm 5-1:1.0: skipping garbage [ 1409.808644][ T2153] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1409.821699][ T2153] cdc_wdm 5-1:1.0: Unknown control protocol [ 1410.239883][ T2153] usb 5-1: USB disconnect, device number 123 [ 1410.246013][ C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1410.356564][T28347] delete_channel: no stack [ 1411.255415][T28486] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5065'. [ 1411.314300][T28486] 8021q: adding VLAN 0 to HW filter on device team2 [ 1411.440606][ T5903] usb 4-1: new full-speed USB device number 116 using dummy_hcd [ 1411.513251][T28520] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5062'. [ 1411.771291][ T5903] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1411.790734][ T5903] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1411.825985][ T5903] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1411.905966][ T5903] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1411.977128][ T5903] hub 4-1:4.0: USB hub found [ 1412.230216][T28480] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1412.256407][T28480] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1412.297420][ T5903] hub 4-1:4.0: config failed, can't read hub descriptor (err -90) [ 1412.616223][ T5903] usb 4-1: USB disconnect, device number 116 [ 1413.323450][T28562] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1413.330725][T28562] IPv6: NLM_F_CREATE should be set when creating new route [ 1413.338033][T28562] IPv6: NLM_F_CREATE should be set when creating new route [ 1413.536490][T28565] ptrace attach of "./syz-executor exec"[23294] was attempted by "./syz-executor exec"[28565] [ 1413.612108][ T5895] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 1413.826938][ T5895] usb 1-1: Using ep0 maxpacket: 16 [ 1413.905544][ T5895] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1413.915267][ T5895] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1413.945748][ T5895] usb 1-1: Product: syz [ 1413.950208][ T5895] usb 1-1: Manufacturer: syz [ 1413.954827][ T5895] usb 1-1: SerialNumber: syz [ 1413.994980][ T5895] r8152-cfgselector 1-1: Unknown version 0x0000 [ 1414.003018][ T5895] r8152-cfgselector 1-1: config 0 descriptor?? [ 1414.297408][T28573] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5075'. [ 1414.306406][T28573] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5075'. [ 1414.537543][ T5895] r8152-cfgselector 1-1: Unknown version 0x0000 [ 1414.599406][ T5895] r8152-cfgselector 1-1: bad CDC descriptors [ 1414.620227][ T5895] r8152-cfgselector 1-1: USB disconnect, device number 105 [ 1414.777306][T28586] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5076'. [ 1415.426078][T12480] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1415.607580][T12480] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1415.635990][T12480] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1415.676778][T12480] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1415.711979][T12480] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1415.775103][T12480] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1415.834917][T12480] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1415.875957][T12480] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1415.935978][T12480] usb 1-1: Product: syz [ 1415.966349][T12480] usb 1-1: Manufacturer: syz [ 1416.012707][T12480] cdc_wdm 1-1:1.0: skipping garbage [ 1416.050265][T12480] cdc_wdm 1-1:1.0: skipping garbage [ 1416.075276][T12480] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 1416.148153][T12480] cdc_wdm 1-1:1.0: Unknown control protocol [ 1416.570245][T28615] FAULT_INJECTION: forcing a failure. [ 1416.570245][T28615] name failslab, interval 1, probability 0, space 0, times 0 [ 1416.636490][ C0] wdm_int_callback: 652 callbacks suppressed [ 1416.636507][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.649145][ C0] wdm_int_callback: 652 callbacks suppressed [ 1416.649155][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.661384][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.668015][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.674335][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.680987][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.687570][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.694215][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.700612][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.707214][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.713466][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.720077][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.726319][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.732910][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.739928][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.746554][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.752820][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.759410][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.765650][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 1416.772232][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 1416.780656][T12480] usb 1-1: USB disconnect, device number 106 [ 1416.786686][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1416.822579][T28615] CPU: 0 UID: 0 PID: 28615 Comm: syz.3.5082 Not tainted 6.16.0-rc3-syzkaller-00057-g92ca6c498a5e #0 PREEMPT(full) [ 1416.822603][T28615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1416.822614][T28615] Call Trace: [ 1416.822622][T28615] [ 1416.822630][T28615] dump_stack_lvl+0x189/0x250 [ 1416.822660][T28615] ? __pfx____ratelimit+0x10/0x10 [ 1416.822686][T28615] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1416.822714][T28615] ? __pfx__printk+0x10/0x10 [ 1416.822737][T28615] ? __pfx___might_resched+0x10/0x10 [ 1416.822763][T28615] ? fs_reclaim_acquire+0x7d/0x100 [ 1416.822788][T28615] should_fail_ex+0x414/0x560 [ 1416.822815][T28615] should_failslab+0xa8/0x100 [ 1416.822835][T28615] __kmalloc_cache_noprof+0x70/0x3d0 [ 1416.822852][T28615] ? rtnl_newlink+0xed/0x1c70 [ 1416.822875][T28615] rtnl_newlink+0xed/0x1c70 [ 1416.822894][T28615] ? __lock_acquire+0xab9/0xd20 [ 1416.822925][T28615] ? __pfx_rtnl_newlink+0x10/0x10 [ 1416.822943][T28615] ? __lock_acquire+0xab9/0xd20 [ 1416.822970][T28615] ? __lock_acquire+0xab9/0xd20 [ 1416.823004][T28615] ? __lock_acquire+0xab9/0xd20 [ 1416.823045][T28615] ? is_bpf_text_address+0x26/0x2b0 [ 1416.823076][T28615] ? is_bpf_text_address+0x292/0x2b0 [ 1416.823100][T28615] ? is_bpf_text_address+0x26/0x2b0 [ 1416.823128][T28615] ? kernel_text_address+0xa5/0xe0 [ 1416.823162][T28615] ? __lock_acquire+0xab9/0xd20 [ 1416.823208][T28615] ? __pfx_rtnl_newlink+0x10/0x10 [ 1416.823225][T28615] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1416.823246][T28615] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1416.823263][T28615] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1416.823296][T28615] netlink_rcv_skb+0x208/0x470 [ 1416.823317][T28615] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1416.823353][T28615] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1416.823384][T28615] ? netlink_deliver_tap+0x2e/0x1b0 [ 1416.823403][T28615] ? netlink_deliver_tap+0x2e/0x1b0 [ 1416.823428][T28615] netlink_unicast+0x75b/0x8d0 [ 1416.823455][T28615] netlink_sendmsg+0x805/0xb30 [ 1416.823484][T28615] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1416.823507][T28615] ? aa_sock_msg_perm+0x94/0x160 [ 1416.823532][T28615] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1416.823554][T28615] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1416.823575][T28615] __sock_sendmsg+0x219/0x270 [ 1416.823604][T28615] ____sys_sendmsg+0x52d/0x830 [ 1416.823631][T28615] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1416.823661][T28615] ? import_iovec+0x74/0xa0 [ 1416.823682][T28615] ___sys_sendmsg+0x21f/0x2a0 [ 1416.823706][T28615] ? __pfx____sys_sendmsg+0x10/0x10 [ 1416.823759][T28615] ? __fget_files+0x2a/0x420 [ 1416.823778][T28615] ? __fget_files+0x3a0/0x420 [ 1416.823807][T28615] __sys_sendmmsg+0x227/0x430 [ 1416.823833][T28615] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1416.823852][T28615] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1416.823902][T28615] ? ksys_write+0x22a/0x250 [ 1416.823920][T28615] ? __pfx_ksys_write+0x10/0x10 [ 1416.823934][T28615] ? rcu_is_watching+0x15/0xb0 [ 1416.823967][T28615] __x64_sys_sendmmsg+0xa0/0xc0 [ 1416.823990][T28615] do_syscall_64+0xfa/0x3b0 [ 1416.824005][T28615] ? lockdep_hardirqs_on+0x9c/0x150 [ 1416.824029][T28615] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1416.824047][T28615] ? clear_bhb_loop+0x60/0xb0 [ 1416.824068][T28615] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1416.824085][T28615] RIP: 0033:0x7f5f4338e929 [ 1416.824101][T28615] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1416.824117][T28615] RSP: 002b:00007f5f44262038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1416.824136][T28615] RAX: ffffffffffffffda RBX: 00007f5f435b5fa0 RCX: 00007f5f4338e929 [ 1416.824149][T28615] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 1416.824161][T28615] RBP: 00007f5f44262090 R08: 0000000000000000 R09: 0000000000000000 [ 1416.824173][T28615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1416.824184][T28615] R13: 0000000000000000 R14: 00007f5f435b5fa0 R15: 00007f5f436dfa28 [ 1416.824210][T28615] [ 1418.091181][T28631] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5085'. [ 1418.141130][T28633] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5084'. [ 1418.171606][T28633] loop2: detected capacity change from 0 to 7 [ 1418.179251][T28630] netlink: 'syz.2.5084': attribute type 5 has an invalid length. [ 1418.204810][T28633] loop2: [ 1418.221447][T28633] loop2: partition table partially beyond EOD, truncated [ 1418.286030][T28639] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5086'. [ 1418.317611][T28630] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5084'. [ 1418.339419][T28639] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5086'. [ 1418.402315][T28639] netlink: 'syz.1.5086': attribute type 1 has an invalid length. [ 1418.547661][T28652] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1418.755747][ T5895] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1418.815129][T28658] netlink: 'syz.4.5090': attribute type 1 has an invalid length. [ 1418.880591][T28658] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5090'. [ 1418.966106][ T5895] usb 2-1: device descriptor read/64, error -71 [ 1418.983399][T28695] netlink: 'syz.0.5091': attribute type 13 has an invalid length. [ 1419.017564][T28695] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5091'. [ 1419.089038][T28697] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1419.515920][ T5895] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1419.786569][ T5895] usb 2-1: device descriptor read/64, error -71 [ 1419.901792][ T5895] usb usb2-port1: attempt power cycle [ 1420.112258][T28658] bond1 (unregistering): Released all slaves [ 1420.184888][T28695] net veth1_virt_wifi virt_wifi0: refused to change device tx_queue_len [ 1420.267858][ T5895] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1420.326034][ T5895] usb 2-1: device descriptor read/8, error -71 [ 1420.457207][T28737] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5095'. [ 1420.471984][T28737] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5095'. [ 1420.616031][ T5895] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1420.777079][ T5895] usb 2-1: device descriptor read/8, error -71 [ 1421.046244][ T5895] usb usb2-port1: unable to enumerate USB device [ 1421.885940][T12480] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 1422.115250][T12480] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1422.155711][T12480] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1422.244378][T12480] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1422.295023][T12480] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1422.338195][T12480] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1422.419018][T12480] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1422.465958][T12480] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1422.486243][T12480] usb 4-1: Product: syz [ 1422.499651][T12480] usb 4-1: Manufacturer: syz [ 1422.531418][T12480] cdc_wdm 4-1:1.0: skipping garbage [ 1422.559160][T12480] cdc_wdm 4-1:1.0: skipping garbage [ 1422.596490][T12480] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1422.631024][T12480] cdc_wdm 4-1:1.0: Unknown control protocol [ 1422.899512][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.908306][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.384913][T28788] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5101'. [ 1423.404850][ C1] wdm_int_callback: 12 callbacks suppressed [ 1423.404873][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.417398][ C1] wdm_int_callback: 12 callbacks suppressed [ 1423.417414][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.429776][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.436387][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.443296][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.449929][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.457020][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.463644][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.470176][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.476795][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.483332][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.489947][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.496503][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.503130][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.509657][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.516275][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.523057][ T5895] usb 4-1: USB disconnect, device number 117 [ 1423.529118][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1423.529139][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1423.529154][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1424.300611][T28804] netlink: 'syz.1.5103': attribute type 1 has an invalid length. [ 1424.341987][T28804] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5103'. [ 1424.352529][T28804] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1425.021804][T28804] bond2 (unregistering): Released all slaves [ 1425.451957][T28882] netlink: 'syz.3.5106': attribute type 12 has an invalid length. [ 1425.460653][T28882] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5106'. [ 1425.933394][T28888] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5109'. [ 1425.965154][T28888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1426.456866][T28909] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5116'. [ 1426.899181][T12480] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1427.200232][T28909] 8021q: adding VLAN 0 to HW filter on device team3 [ 1427.209768][T12480] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1427.219743][T12480] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1427.244873][T12480] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1427.267251][T12480] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1427.282450][T12480] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1427.346353][T12480] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1427.395940][T12480] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1427.403967][T12480] usb 2-1: Product: syz [ 1427.454460][T12480] usb 2-1: Manufacturer: syz [ 1427.493940][T12480] cdc_wdm 2-1:1.0: skipping garbage [ 1427.525394][T12480] cdc_wdm 2-1:1.0: skipping garbage [ 1427.572932][T12480] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1427.634686][T12480] cdc_wdm 2-1:1.0: Unknown control protocol [ 1427.906277][T28983] vlan2: entered promiscuous mode [ 1428.017977][T12480] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 1428.137044][ C1] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1428.137539][ T5903] usb 2-1: USB disconnect, device number 7 [ 1428.143672][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1428.143693][ C1] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1428.176336][T12480] usb 3-1: Using ep0 maxpacket: 16 [ 1428.207112][T12480] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1428.266538][T12480] usb 3-1: config 1 interface 0 has no altsetting 0 [ 1428.276264][T12480] usb 3-1: New USB device found, idVendor=16c0, idProduct=75e1, bcdDevice= 0.40 [ 1428.285516][T12480] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1428.295739][T12480] usb 3-1: Product: syz [ 1428.317977][T12480] usb 3-1: Manufacturer: syz [ 1428.325135][T12480] usb 3-1: SerialNumber: syz [ 1428.724582][T12480] usbhid 3-1:1.0: can't add hid device: -71 [ 1428.736283][T12480] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 1428.773965][ T5903] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1428.786115][T12480] usb 3-1: USB disconnect, device number 102 [ 1429.006013][ T5903] usb 2-1: Using ep0 maxpacket: 32 [ 1429.022051][ T5903] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1429.060042][ T5903] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1429.091350][ T5903] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1429.125699][ T5903] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1429.155356][ T5903] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1429.199709][ T5903] usb 2-1: config 0 descriptor?? [ 1429.217035][T29002] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1429.259423][ T5903] hub 2-1:0.0: USB hub found [ 1429.305082][T29036] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5130'. [ 1429.503105][T29058] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5134'. [ 1429.511799][T29056] openvswitch: netlink: Geneve opt len 126 is not a multiple of 4. [ 1429.517730][T29058] netlink: 'syz.3.5134': attribute type 3 has an invalid length. [ 1429.520213][ T5903] hub 2-1:0.0: config failed, hub has too many ports! (err -19) [ 1429.613382][T29041] sch_tbf: burst 1885 is lower than device lo mtu (65550) ! [ 1429.651699][T29047] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5133'. [ 1429.695289][T29056] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1429.742150][T29056] bridge0: port 2(bridge_slave_1) entered disabled state [ 1429.749873][T29056] bridge0: port 1(bridge_slave_0) entered disabled state [ 1429.832371][ T5903] usbhid 2-1:0.0: can't add hid device: -71 [ 1429.859718][ T5903] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1429.919018][ T5903] usb 2-1: USB disconnect, device number 8 [ 1430.282921][T29091] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5138'. [ 1430.291911][T29091] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5138'. [ 1430.368293][T29092] vivid-000: ================= START STATUS ================= [ 1430.376252][T29092] vivid-000: Test Pattern: 75% Colorbar [ 1430.381872][T29092] vivid-000: Fill Percentage of Frame: 100 [ 1430.414536][T29092] vivid-000: Horizontal Movement: Move Left Slow [ 1430.503054][T29092] vivid-000: Vertical Movement: No Movement [ 1430.557506][T29092] vivid-000: OSD Text Mode: All [ 1430.568733][T29092] vivid-000: Show Border: false [ 1430.595743][T29092] vivid-000: Show Square: false [ 1430.600902][T29092] vivid-000: Sensor Flipped Horizontally: false [ 1430.607614][T29092] vivid-000: Sensor Flipped Vertically: false [ 1430.614192][T29092] vivid-000: Insert SAV Code in Image: false [ 1430.635658][T29092] vivid-000: Insert EAV Code in Image: false [ 1430.658000][T29092] vivid-000: Insert Video Guard Band: false [ 1430.679745][T29092] vivid-000: Reduced Framerate: false [ 1430.685186][T29092] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 1430.692954][T29092] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 1430.710030][T29092] vivid-000: Enable Capture Cropping: true grabbed [ 1430.718024][T29092] vivid-000: Enable Capture Composing: true grabbed [ 1430.727895][T29092] vivid-000: Enable Capture Scaler: true grabbed [ 1430.736120][T29092] vivid-000: Timestamp Source: End of Frame [ 1430.747306][T29092] vivid-000: Colorspace: Rec. 709 [ 1430.765883][T29092] vivid-000: Transfer Function: Default [ 1430.771684][T29092] vivid-000: Y'CbCr Encoding: Default [ 1430.780684][T29092] vivid-000: HSV Encoding: Hue 0-179 [ 1430.794282][T29092] vivid-000: Quantization: Default [ 1430.800014][T29092] vivid-000: Apply Alpha To Red Only: false [ 1430.812222][T29092] vivid-000: Standard Aspect Ratio: 4x3 [ 1430.824178][T29092] vivid-000: DV Timings Signal Mode: Current DV Timings [ 1430.836885][T29092] vivid-000: DV Timings: 640x480p59 inactive [ 1430.870273][T29092] vivid-000: DV Timings Aspect Ratio: 4x3 [ 1430.882519][T29092] vivid-000: Maximum EDID Blocks: 2 [ 1430.894974][T29092] vivid-000: Limited RGB Range (16-235): true [ 1430.909480][T29092] vivid-000: Rx RGB Quantization Range: Automatic [ 1430.923123][T29092] vivid-000: Power Present: 0x00000001 [ 1430.931755][T29092] tpg source WxH: 1280x720 (Y'CbCr) [ 1430.940234][T29092] tpg field: 1 [ 1430.946248][T29092] tpg crop: (0,0)/64x64 [ 1430.950804][T29092] tpg compose: (0,0)/16x16 [ 1430.957495][T29092] tpg colorspace: 3 [ 1430.963107][T29092] tpg transfer function: 0/1 [ 1430.968727][T29092] tpg Y'CbCr encoding: 0/2 [ 1430.974261][T29092] tpg quantization: 0/2 [ 1430.983457][T29092] tpg RGB range: 0/1 [ 1430.993511][T29092] vivid-000: ================== END STATUS ================== [ 1431.057692][ T30] kauditd_printk_skb: 107 callbacks suppressed [ 1431.057709][ T30] audit: type=1326 audit(1750898478.673:2465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29100 comm="syz.1.5140" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe98b38e929 code=0x0 [ 1431.405256][T29110] binder: BINDER_SET_CONTEXT_MGR already set [ 1431.411817][T29110] binder: 29079:29110 ioctl 4018620d 200000000040 returned -16 [ 1432.026515][ T5895] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 1432.247493][ T5895] usb 5-1: Using ep0 maxpacket: 16 [ 1432.984514][T29135] netlink: 'syz.0.5146': attribute type 10 has an invalid length. [ 1433.180894][T29135] mac80211_hwsim hwsim40 wlan1: entered promiscuous mode [ 1433.204877][T29135] team0: Port device wlan1 added [ 1434.079061][T29145] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1434.209247][T29150] bond_slave_0: entered promiscuous mode [ 1434.215002][T29150] bond_slave_1: entered promiscuous mode [ 1434.220779][T29150] mac80211_hwsim hwsim48 wlan1: entered promiscuous mode [ 1434.263834][T29150] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1434.274941][T29150] bond4: (slave macvlan0): making interface the new active one [ 1434.284428][T29150] bond4: (slave macvlan0): Enslaving as an active interface with an up link [ 1435.268670][ T5895] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1435.310243][ T5895] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 1435.366014][ T5895] usb 5-1: can't read configurations, error -71 [ 1435.513376][T20219] hid-generic 0000:0000:0000.0047: unknown main item tag 0x0 [ 1435.542162][T20219] hid-generic 0000:0000:0000.0047: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1435.584344][T29227] netlink: 'syz.4.5161': attribute type 1 has an invalid length. [ 1435.770728][T29227] bond1 (unregistering): Released all slaves [ 1435.780208][T29271] netlink: 'syz.3.5160': attribute type 27 has an invalid length. [ 1436.188151][ T30] audit: type=1804 audit(1750898483.853:2466): pid=29315 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.5167" name="/newroot/431/file1" dev="fuse" ino=1 res=1 errno=0 [ 1436.321273][T29271] tipc: Resetting bearer [ 1436.476355][ T5903] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 1436.613809][T29338] autofs4:pid:29338:validate_dev_ioctl: path string terminator missing for cmd(0xc018937e) [ 1436.657127][ T5903] usb 1-1: Using ep0 maxpacket: 16 [ 1436.664446][ T5903] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1436.673743][ T5903] usb 1-1: config 1 has an invalid interface number: 26 but max is 1 [ 1436.682547][ T5903] usb 1-1: config 1 has an invalid interface number: 89 but max is 1 [ 1436.697946][ T5903] usb 1-1: config 1 has an invalid descriptor of length 11, skipping remainder of the config [ 1436.718900][ T5903] usb 1-1: config 1 has no interface number 0 [ 1436.741440][ T5903] usb 1-1: config 1 has no interface number 1 [ 1436.760452][ T5903] usb 1-1: config 1 interface 26 altsetting 213 bulk endpoint 0xC has invalid maxpacket 1023 [ 1436.794727][ T5903] usb 1-1: config 1 interface 26 altsetting 213 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 1436.820477][ T5903] usb 1-1: config 1 interface 26 altsetting 213 bulk endpoint 0xD has invalid maxpacket 8 [ 1436.871075][ T5903] usb 1-1: config 1 interface 26 altsetting 213 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1436.952323][ T5903] usb 1-1: config 1 interface 26 altsetting 213 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 1437.025098][ T5903] usb 1-1: config 1 interface 89 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1437.039447][T29271] ipvlan0: left promiscuous mode [ 1437.044402][T29271] ipvlan0: left allmulticast mode [ 1437.060717][T29271] veth0_vlan: left allmulticast mode [ 1437.068671][ T5903] usb 1-1: config 1 interface 26 has no altsetting 0 [ 1437.080187][ T5903] usb 1-1: config 1 interface 89 has no altsetting 0 [ 1437.102208][ T5903] usb 1-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=29.ec [ 1437.129529][ T5903] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1437.169947][ T5903] usb 1-1: Product: syz [ 1437.174263][T29271] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.184572][T29271] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.193760][ T5903] usb 1-1: Manufacturer: syz [ 1437.193781][ T5903] usb 1-1: SerialNumber: syz [ 1437.238353][T29315] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1437.249473][T29271] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.261030][T29315] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1437.273845][T29271] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.438230][T29271] bond0: left allmulticast mode [ 1437.457975][T29271] bond_slave_0: left allmulticast mode [ 1437.483807][T29271] bond_slave_1: left allmulticast mode [ 1437.503572][ T5903] usb 1-1: unknown interface protocol 0x7d, assuming v1 [ 1437.527312][ T5903] usb 1-1: 26:2 : does not exist [ 1437.534503][T29271] bond0: left promiscuous mode [ 1437.554732][T29271] bond_slave_0: left promiscuous mode [ 1437.570105][T29271] bond_slave_1: left promiscuous mode [ 1437.593338][ T5903] usb 1-1: unknown interface protocol 0x13, assuming v1 [ 1437.610629][T29271] macvtap0: left promiscuous mode [ 1437.615684][T29271] macvtap0: left allmulticast mode [ 1437.626337][ T5903] usb 1-1: 89:2 : does not exist [ 1437.710820][ T5903] usb 1-1: USB disconnect, device number 107 [ 1437.810946][T29271] ip6gre1: left allmulticast mode [ 1437.841381][T29271] ip6gretap2: left allmulticast mode [ 1438.288117][T29271] bridge0: left promiscuous mode [ 1439.112744][T29397] netlink: 80 bytes leftover after parsing attributes in process `syz.1.5180'. [ 1439.125546][T29397] netlink: 80 bytes leftover after parsing attributes in process `syz.1.5180'. [ 1439.212757][T18493] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 1439.418136][T18493] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1439.459542][T18493] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1439.471020][T18493] usb 1-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 1439.482627][T18493] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1439.493130][T18493] usb 1-1: config 0 descriptor?? [ 1439.516040][T12480] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 1439.697878][T12480] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1439.710691][T12480] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1439.743404][T12480] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1439.754028][T12480] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1439.772592][T12480] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1439.807134][T12480] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1439.820033][T12480] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1439.850312][T12480] usb 2-1: Product: syz [ 1439.865185][T12480] usb 2-1: Manufacturer: syz [ 1439.909995][T12480] cdc_wdm 2-1:1.0: skipping garbage [ 1439.915315][T12480] cdc_wdm 2-1:1.0: skipping garbage [ 1439.946207][T20219] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 1439.950954][T12480] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1439.965510][T12480] cdc_wdm 2-1:1.0: Unknown control protocol [ 1440.141157][T18493] hid-led 0003:0FC5:B080.0048: probe with driver hid-led failed with error -71 [ 1440.172815][T18493] usb 1-1: USB disconnect, device number 108 [ 1440.196130][T20219] usb 4-1: Using ep0 maxpacket: 32 [ 1440.204081][T29421] loop2: detected capacity change from 0 to 3 [ 1440.212015][T29421] ldm_validate_privheads(): Disk read failed. [ 1440.296732][T29421] Dev loop2: unable to read RDB block 3 [ 1440.302383][T29421] loop2: unable to read partition table [ 1440.380992][T29421] loop2: partition table beyond EOD, truncated [ 1440.393416][T29421] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1440.412877][T20219] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1440.422756][T20219] usb 4-1: too many configurations: 105, using maximum allowed: 8 [ 1440.442781][T20219] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 1440.455673][T20219] usb 4-1: can't read configurations, error -71 [ 1441.009456][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.016099][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.022385][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.028980][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.035214][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.041892][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.049036][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.055643][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.061905][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.068500][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.074730][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.081317][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.088060][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.094655][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.100905][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.107491][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.113725][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.120329][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.126618][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 1441.133294][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 1441.147107][T18493] usb 2-1: USB disconnect, device number 9 [ 1441.147272][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1441.522077][T29477] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5191'. [ 1441.631122][T29479] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5192'. [ 1441.651665][T29479] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5192'. [ 1441.916539][T29489] openvswitch: netlink: Message has 4 unknown bytes. [ 1441.923397][T29489] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1442.285965][ T5926] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1442.457766][ T5926] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1442.495964][ T5926] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1442.518399][ T5926] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1442.542550][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1442.690902][T29504] netlink: 'syz.4.5200': attribute type 1 has an invalid length. [ 1442.726498][ T5926] usb 2-1: Product: syz [ 1442.732034][ T5926] usb 2-1: Manufacturer: syz [ 1442.740755][ T5926] usb 2-1: SerialNumber: syz [ 1442.749206][ T5926] usb 2-1: config 0 descriptor?? [ 1442.759804][ T5926] usb 2-1: selecting invalid altsetting 0 [ 1443.038098][T29517] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 1443.080798][T29560] FAULT_INJECTION: forcing a failure. [ 1443.080798][T29560] name failslab, interval 1, probability 0, space 0, times 0 [ 1443.137627][T29554] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 1443.177761][T29560] CPU: 0 UID: 0 PID: 29560 Comm: syz.1.5198 Not tainted 6.16.0-rc3-syzkaller-00057-g92ca6c498a5e #0 PREEMPT(full) [ 1443.177791][T29560] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1443.177805][T29560] Call Trace: [ 1443.177814][T29560] [ 1443.177824][T29560] dump_stack_lvl+0x189/0x250 [ 1443.177861][T29560] ? __pfx____ratelimit+0x10/0x10 [ 1443.177891][T29560] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1443.177923][T29560] ? __pfx__printk+0x10/0x10 [ 1443.177952][T29560] ? __pfx___might_resched+0x10/0x10 [ 1443.177988][T29560] should_fail_ex+0x414/0x560 [ 1443.178020][T29560] should_failslab+0xa8/0x100 [ 1443.178044][T29560] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 1443.178066][T29560] ? __alloc_skb+0x112/0x2d0 [ 1443.178093][T29560] __alloc_skb+0x112/0x2d0 [ 1443.178120][T29560] netlink_sendmsg+0x5c6/0xb30 [ 1443.178155][T29560] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1443.178183][T29560] ? aa_sock_msg_perm+0x94/0x160 [ 1443.178212][T29560] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1443.178238][T29560] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1443.178263][T29560] __sock_sendmsg+0x219/0x270 [ 1443.178297][T29560] ____sys_sendmsg+0x505/0x830 [ 1443.178329][T29560] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1443.178371][T29560] ? import_iovec+0x74/0xa0 [ 1443.178397][T29560] ___sys_sendmsg+0x21f/0x2a0 [ 1443.178425][T29560] ? __pfx____sys_sendmsg+0x10/0x10 [ 1443.178489][T29560] ? __fget_files+0x2a/0x420 [ 1443.178511][T29560] ? __fget_files+0x3a0/0x420 [ 1443.178549][T29560] __x64_sys_sendmsg+0x19b/0x260 [ 1443.178578][T29560] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1443.178613][T29560] ? __pfx_ksys_write+0x10/0x10 [ 1443.178630][T29560] ? rcu_is_watching+0x15/0xb0 [ 1443.178668][T29560] ? do_syscall_64+0xbe/0x3b0 [ 1443.178704][T29560] do_syscall_64+0xfa/0x3b0 [ 1443.178720][T29560] ? lockdep_hardirqs_on+0x9c/0x150 [ 1443.178759][T29560] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1443.178776][T29560] ? clear_bhb_loop+0x60/0xb0 [ 1443.178798][T29560] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1443.178815][T29560] RIP: 0033:0x7fe98b38e929 [ 1443.178831][T29560] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1443.178846][T29560] RSP: 002b:00007fe9891b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1443.178866][T29560] RAX: ffffffffffffffda RBX: 00007fe98b5b6160 RCX: 00007fe98b38e929 [ 1443.178879][T29560] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000007 [ 1443.178891][T29560] RBP: 00007fe9891b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1443.178902][T29560] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1443.178913][T29560] R13: 0000000000000000 R14: 00007fe98b5b6160 R15: 00007fe98b6dfa28 [ 1443.178940][T29560] [ 1443.597260][T29570] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5205'. [ 1443.660360][T29573] netlink: 80 bytes leftover after parsing attributes in process `syz.0.5204'. [ 1443.683978][T29554] bond1 (unregistering): Released all slaves [ 1443.756218][T29573] netlink: 80 bytes leftover after parsing attributes in process `syz.0.5204'. [ 1443.846248][ T5926] usb 2-1: USB disconnect, device number 10 [ 1443.995999][T12480] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1444.025148][T29570] FAULT_INJECTION: forcing a failure. [ 1444.025148][T29570] name failslab, interval 1, probability 0, space 0, times 0 [ 1444.103654][T29570] CPU: 1 UID: 0 PID: 29570 Comm: syz.2.5205 Not tainted 6.16.0-rc3-syzkaller-00057-g92ca6c498a5e #0 PREEMPT(full) [ 1444.103682][T29570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1444.103693][T29570] Call Trace: [ 1444.103701][T29570] [ 1444.103709][T29570] dump_stack_lvl+0x189/0x250 [ 1444.103743][T29570] ? __pfx____ratelimit+0x10/0x10 [ 1444.103769][T29570] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1444.103796][T29570] ? __pfx__printk+0x10/0x10 [ 1444.103821][T29570] ? __pfx___might_resched+0x10/0x10 [ 1444.103846][T29570] ? fs_reclaim_acquire+0x7d/0x100 [ 1444.103872][T29570] should_fail_ex+0x414/0x560 [ 1444.103899][T29570] ? alloc_netdev_mqs+0x8e5/0x11e0 [ 1444.103922][T29570] should_failslab+0xa8/0x100 [ 1444.103943][T29570] __kvmalloc_node_noprof+0x161/0x5f0 [ 1444.103963][T29570] ? alloc_netdev_mqs+0x8e5/0x11e0 [ 1444.103992][T29570] alloc_netdev_mqs+0x8e5/0x11e0 [ 1444.104023][T29570] rtnl_create_link+0x31f/0xd10 [ 1444.104054][T29570] rtnl_newlink_create+0x25c/0xb00 [ 1444.104081][T29570] ? __mutex_lock+0x51b/0xe80 [ 1444.104112][T29570] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1444.104131][T29570] ? rtnl_newlink+0x8db/0x1c70 [ 1444.104152][T29570] ? __pfx___mutex_lock+0x10/0x10 [ 1444.104187][T29570] ? ns_capable+0x8a/0xf0 [ 1444.104218][T29570] rtnl_newlink+0x16d6/0x1c70 [ 1444.104237][T29570] ? netlink_sendmsg+0x805/0xb30 [ 1444.104269][T29570] ? __pfx_rtnl_newlink+0x10/0x10 [ 1444.104316][T29570] ? kasan_quarantine_put+0xdd/0x220 [ 1444.104342][T29570] ? lockdep_hardirqs_on+0x9c/0x150 [ 1444.104373][T29570] ? nlmon_xmit+0xb0/0x100 [ 1444.104397][T29570] ? kmem_cache_free+0x18f/0x400 [ 1444.104421][T29570] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1444.104447][T29570] ? lockdep_hardirqs_on+0x9c/0x150 [ 1444.104473][T29570] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1444.104498][T29570] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1444.104528][T29570] ? __dev_queue_xmit+0x27e/0x3a70 [ 1444.104564][T29570] ? __lock_acquire+0xab9/0xd20 [ 1444.104613][T29570] ? __pfx_rtnl_newlink+0x10/0x10 [ 1444.104630][T29570] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1444.104651][T29570] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1444.104669][T29570] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1444.104685][T29570] ? ref_tracker_free+0x63a/0x7d0 [ 1444.104706][T29570] ? __copy_skb_header+0xa7/0x550 [ 1444.104730][T29570] ? __pfx_ref_tracker_free+0x10/0x10 [ 1444.104763][T29570] netlink_rcv_skb+0x208/0x470 [ 1444.104784][T29570] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1444.104804][T29570] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1444.104836][T29570] ? netlink_deliver_tap+0x2e/0x1b0 [ 1444.104856][T29570] ? netlink_deliver_tap+0x2e/0x1b0 [ 1444.104882][T29570] netlink_unicast+0x75b/0x8d0 [ 1444.104910][T29570] netlink_sendmsg+0x805/0xb30 [ 1444.104939][T29570] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1444.104963][T29570] ? aa_sock_msg_perm+0x94/0x160 [ 1444.104988][T29570] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1444.105011][T29570] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1444.105033][T29570] __sock_sendmsg+0x219/0x270 [ 1444.105064][T29570] ____sys_sendmsg+0x505/0x830 [ 1444.105092][T29570] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1444.105122][T29570] ? import_iovec+0x74/0xa0 [ 1444.105144][T29570] ___sys_sendmsg+0x21f/0x2a0 [ 1444.105168][T29570] ? __pfx____sys_sendmsg+0x10/0x10 [ 1444.105225][T29570] ? __fget_files+0x2a/0x420 [ 1444.105244][T29570] ? __fget_files+0x3a0/0x420 [ 1444.105274][T29570] __x64_sys_sendmsg+0x19b/0x260 [ 1444.105298][T29570] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1444.105336][T29570] ? __pfx_ksys_write+0x10/0x10 [ 1444.105351][T29570] ? rcu_is_watching+0x15/0xb0 [ 1444.105383][T29570] ? do_syscall_64+0xbe/0x3b0 [ 1444.105402][T29570] do_syscall_64+0xfa/0x3b0 [ 1444.105417][T29570] ? lockdep_hardirqs_on+0x9c/0x150 [ 1444.105442][T29570] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1444.105460][T29570] ? clear_bhb_loop+0x60/0xb0 [ 1444.105481][T29570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1444.105499][T29570] RIP: 0033:0x7f89bef8e929 [ 1444.105515][T29570] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1444.105530][T29570] RSP: 002b:00007f89bcdf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1444.105549][T29570] RAX: ffffffffffffffda RBX: 00007f89bf1b5fa0 RCX: 00007f89bef8e929 [ 1444.105563][T29570] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 000000000000000e [ 1444.105574][T29570] RBP: 00007f89bcdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1444.105586][T29570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1444.105596][T29570] R13: 0000000000000000 R14: 00007f89bf1b5fa0 R15: 00007f89bf2dfa28 [ 1444.105625][T29570] [ 1444.553933][T12480] usb 4-1: Using ep0 maxpacket: 32 [ 1444.705126][ T5926] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1444.718457][T12480] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=3d.42 [ 1444.735987][T12480] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1444.764392][T12480] usb 4-1: Product: syz [ 1444.795587][T12480] usb 4-1: Manufacturer: syz [ 1444.812155][T12480] usb 4-1: SerialNumber: syz [ 1444.822287][T17676] bond_slave_0: left promiscuous mode [ 1444.835790][T12480] usb 4-1: config 0 descriptor?? [ 1444.932074][ T5926] usb 2-1: Using ep0 maxpacket: 16 [ 1444.963741][ T5926] usb 2-1: config 0 has an invalid interface number: 152 but max is 0 [ 1444.974355][T12480] ttusb_dec_send_command: command bulk message failed: error -22 [ 1444.994788][ T5926] usb 2-1: config 0 has an invalid descriptor of length 36, skipping remainder of the config [ 1445.012111][T12480] ttusb-dec 4-1:0.0: probe with driver ttusb-dec failed with error -22 [ 1445.052443][ T5926] usb 2-1: config 0 has no interface number 0 [ 1445.077299][ T5926] usb 2-1: config 0 interface 152 has no altsetting 0 [ 1445.110425][T12480] usb 4-1: USB disconnect, device number 120 [ 1445.130752][ T5926] usb 2-1: New USB device found, idVendor=05c6, idProduct=9215, bcdDevice=70.72 [ 1445.154937][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1445.156077][T20219] usb 5-1: new full-speed USB device number 126 using dummy_hcd [ 1445.167698][ T5926] usb 2-1: Product: syz [ 1445.175045][ T5926] usb 2-1: Manufacturer: syz [ 1445.180966][ T5926] usb 2-1: SerialNumber: syz [ 1445.202387][ T5926] usb 2-1: config 0 descriptor?? [ 1445.228094][ T5926] usbhid 2-1:0.152: couldn't find an input interrupt endpoint [ 1445.358518][T20219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1445.379915][T20219] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1445.405942][T20219] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1445.414558][ T5926] usb 2-1: USB disconnect, device number 11 [ 1445.430599][T20219] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1445.459438][T20219] usb 5-1: config 0 descriptor?? [ 1446.021897][T17676] bond1 (unregistering): (slave macvlan2): Releasing active interface [ 1446.073148][T20219] usb 5-1: string descriptor 0 read error: -22 [ 1446.152228][T17676] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1446.172576][T17676] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1446.183389][T17676] bond0 (unregistering): Released all slaves [ 1446.282018][T20219] uclogic 0003:256C:006D.0049: interface is invalid, ignoring [ 1446.369136][ T5895] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 1446.451238][T17676] bond1 (unregistering): Released all slaves [ 1446.541362][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1446.555733][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1446.593309][ T5895] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1446.613343][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1446.641323][ T5895] usb 3-1: config 0 descriptor?? [ 1446.718676][T17676] bond2 (unregistering): Released all slaves [ 1446.950810][T17676] bond3 (unregistering): Released all slaves [ 1447.086657][ T5895] isku 0003:1E7D:319C.004A: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.2-1/input0 [ 1447.251143][T17676] bond4 (unregistering): Released all slaves [ 1447.284170][T17676] bond5 (unregistering): Released all slaves [ 1447.308738][T29694] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5217'. [ 1447.324312][T17676] bond6 (unregistering): Released all slaves [ 1447.394872][T12480] usb 5-1: USB disconnect, device number 126 [ 1447.897030][T29732] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 1448.044647][T29738] netlink: 'syz.0.5221': attribute type 23 has an invalid length. [ 1448.058462][T29738] xt_hashlimit: max too large, truncated to 1048576 [ 1448.075030][T29738] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not '' [ 1448.083707][T20219] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1448.286256][T20219] usb 4-1: Using ep0 maxpacket: 8 [ 1448.296571][T20219] usb 4-1: config 0 has an invalid interface number: 130 but max is 0 [ 1448.305164][T20219] usb 4-1: config 0 has no interface number 0 [ 1448.319622][T20219] usb 4-1: New USB device found, idVendor=0403, idProduct=fa78, bcdDevice=71.1b [ 1448.352377][T20219] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1448.378506][T17676] [ 1448.380867][T17676] ====================================================== [ 1448.387899][T17676] WARNING: possible circular locking dependency detected [ 1448.394928][T17676] 6.16.0-rc3-syzkaller-00057-g92ca6c498a5e #0 Not tainted [ 1448.402024][T17676] ------------------------------------------------------ [ 1448.409035][T17676] kworker/u8:1/17676 is trying to acquire lock: [ 1448.415259][T17676] ffff888034fa0e00 (team->team_lock_key#7){+.+.}-{4:4}, at: team_del_slave+0x32/0x1c0 [ 1448.424840][T17676] [ 1448.424840][T17676] but task is already holding lock: [ 1448.432201][T17676] ffff88801df38768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 1448.442553][T17676] [ 1448.442553][T17676] which lock already depends on the new lock. [ 1448.442553][T17676] [ 1448.453036][T17676] [ 1448.453036][T17676] the existing dependency chain (in reverse order) is: [ 1448.462041][T17676] [ 1448.462041][T17676] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 1448.469776][T17676] lock_acquire+0x120/0x360 [ 1448.474833][T17676] __mutex_lock+0x182/0xe80 [ 1448.479889][T17676] ieee80211_open+0xed/0x1f0 [ 1448.485002][T17676] __dev_open+0x470/0x880 [ 1448.489887][T17676] netif_open+0xaa/0x170 [ 1448.494657][T17676] dev_open+0x125/0x260 [ 1448.499342][T17676] team_add_slave+0xb36/0x2840 [ 1448.504629][T17676] do_set_master+0x530/0x6d0 [ 1448.509745][T17676] do_setlink+0xcf0/0x41c0 [ 1448.514691][T17676] rtnl_newlink+0x160b/0x1c70 [ 1448.519889][T17676] rtnetlink_rcv_msg+0x7cc/0xb70 [ 1448.525343][T17676] netlink_rcv_skb+0x208/0x470 [ 1448.530633][T17676] netlink_unicast+0x75b/0x8d0 [ 1448.535924][T17676] netlink_sendmsg+0x805/0xb30 [ 1448.541204][T17676] __sock_sendmsg+0x219/0x270 [ 1448.546403][T17676] ____sys_sendmsg+0x505/0x830 [ 1448.551682][T17676] ___sys_sendmsg+0x21f/0x2a0 [ 1448.556883][T17676] __x64_sys_sendmsg+0x19b/0x260 [ 1448.562343][T17676] do_syscall_64+0xfa/0x3b0 [ 1448.567359][T17676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1448.573861][T17676] [ 1448.573861][T17676] -> #0 (team->team_lock_key#7){+.+.}-{4:4}: [ 1448.582041][T17676] validate_chain+0xb9b/0x2140 [ 1448.587317][T17676] __lock_acquire+0xab9/0xd20 [ 1448.592515][T17676] lock_acquire+0x120/0x360 [ 1448.597537][T17676] __mutex_lock+0x182/0xe80 [ 1448.602592][T17676] team_del_slave+0x32/0x1c0 [ 1448.607728][T17676] team_device_event+0x285/0xa20 [ 1448.613207][T17676] notifier_call_chain+0x1b3/0x3e0 [ 1448.618863][T17676] unregister_netdevice_many_notify+0x15d8/0x2320 [ 1448.625813][T17676] unregister_netdevice_queue+0x33c/0x380 [ 1448.632063][T17676] _cfg80211_unregister_wdev+0x165/0x590 [ 1448.638213][T17676] ieee80211_remove_interfaces+0x49a/0x6d0 [ 1448.644634][T17676] ieee80211_unregister_hw+0x5d/0x2c0 [ 1448.650526][T17676] mac80211_hwsim_del_radio+0x275/0x460 [ 1448.656601][T17676] hwsim_exit_net+0x584/0x640 [ 1448.661802][T17676] ops_undo_list+0x49a/0x990 [ 1448.666909][T17676] cleanup_net+0x4c5/0x800 [ 1448.671839][T17676] process_scheduled_works+0xae1/0x17b0 [ 1448.677911][T17676] worker_thread+0x8a0/0xda0 [ 1448.683028][T17676] kthread+0x70e/0x8a0 [ 1448.687611][T17676] ret_from_fork+0x3fc/0x770 [ 1448.692726][T17676] ret_from_fork_asm+0x1a/0x30 [ 1448.698007][T17676] [ 1448.698007][T17676] other info that might help us debug this: [ 1448.698007][T17676] [ 1448.708231][T17676] Possible unsafe locking scenario: [ 1448.708231][T17676] [ 1448.715670][T17676] CPU0 CPU1 [ 1448.721023][T17676] ---- ---- [ 1448.726383][T17676] lock(&rdev->wiphy.mtx); [ 1448.730904][T17676] lock(team->team_lock_key#7); [ 1448.738362][T17676] lock(&rdev->wiphy.mtx); [ 1448.745380][T17676] lock(team->team_lock_key#7); [ 1448.750318][T17676] [ 1448.750318][T17676] *** DEADLOCK *** [ 1448.750318][T17676] [ 1448.758455][T17676] 5 locks held by kworker/u8:1/17676: [ 1448.763817][T17676] #0: ffff88801b2fe148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1448.774779][T17676] #1: ffffc9000468fbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1448.785301][T17676] #2: ffffffff8f503350 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 1448.794601][T17676] #3: ffffffff8f50ff48 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 [ 1448.804424][T17676] #4: ffff88801df38768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 1448.815205][T17676] [ 1448.815205][T17676] stack backtrace: [ 1448.821082][T17676] CPU: 1 UID: 0 PID: 17676 Comm: kworker/u8:1 Not tainted 6.16.0-rc3-syzkaller-00057-g92ca6c498a5e #0 PREEMPT(full) [ 1448.821099][T17676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1448.821108][T17676] Workqueue: netns cleanup_net [ 1448.821122][T17676] Call Trace: [ 1448.821129][T17676] [ 1448.821134][T17676] dump_stack_lvl+0x189/0x250 [ 1448.821155][T17676] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1448.821174][T17676] ? __pfx__printk+0x10/0x10 [ 1448.821188][T17676] ? print_lock_name+0xde/0x100 [ 1448.821201][T17676] print_circular_bug+0x2ee/0x310 [ 1448.821216][T17676] check_noncircular+0x134/0x160 [ 1448.821230][T17676] validate_chain+0xb9b/0x2140 [ 1448.821244][T17676] ? lockdep_hardirqs_on+0x9c/0x150 [ 1448.821266][T17676] __lock_acquire+0xab9/0xd20 [ 1448.821285][T17676] ? team_del_slave+0x32/0x1c0 [ 1448.821303][T17676] lock_acquire+0x120/0x360 [ 1448.821319][T17676] ? team_del_slave+0x32/0x1c0 [ 1448.821339][T17676] ? __mutex_trylock_common+0x153/0x260 [ 1448.821353][T17676] __mutex_lock+0x182/0xe80 [ 1448.821372][T17676] ? team_del_slave+0x32/0x1c0 [ 1448.821390][T17676] ? rcu_is_watching+0x15/0xb0 [ 1448.821412][T17676] ? team_del_slave+0x32/0x1c0 [ 1448.821431][T17676] ? __pfx___mutex_lock+0x10/0x10 [ 1448.821449][T17676] ? bond_netdev_event+0xd9/0xe80 [ 1448.821463][T17676] ? __pfx___mutex_lock+0x10/0x10 [ 1448.821481][T17676] ? __pfx_bond_netdev_event+0x10/0x10 [ 1448.821496][T17676] team_del_slave+0x32/0x1c0 [ 1448.821515][T17676] team_device_event+0x285/0xa20 [ 1448.821531][T17676] notifier_call_chain+0x1b3/0x3e0 [ 1448.821553][T17676] unregister_netdevice_many_notify+0x15d8/0x2320 [ 1448.821576][T17676] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1448.821595][T17676] ? __lock_acquire+0xab9/0xd20 [ 1448.821618][T17676] unregister_netdevice_queue+0x33c/0x380 [ 1448.821636][T17676] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1448.821655][T17676] _cfg80211_unregister_wdev+0x165/0x590 [ 1448.821671][T17676] ieee80211_remove_interfaces+0x49a/0x6d0 [ 1448.821692][T17676] ? __pfx_synchronize_rcu+0x10/0x10 [ 1448.821704][T17676] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 1448.821723][T17676] ? rcu_is_watching+0x15/0xb0 [ 1448.821744][T17676] ieee80211_unregister_hw+0x5d/0x2c0 [ 1448.821762][T17676] mac80211_hwsim_del_radio+0x275/0x460 [ 1448.821776][T17676] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 1448.821792][T17676] hwsim_exit_net+0x584/0x640 [ 1448.821811][T17676] ? __pfx_hwsim_exit_net+0x10/0x10 [ 1448.821830][T17676] ? __ip_vs_dev_cleanup_batch+0x238/0x260 [ 1448.821845][T17676] ops_undo_list+0x49a/0x990 [ 1448.821882][T17676] ? __pfx_ops_undo_list+0x10/0x10 [ 1448.821900][T17676] cleanup_net+0x4c5/0x800 [ 1448.821914][T17676] ? __pfx_cleanup_net+0x10/0x10 [ 1448.821928][T17676] ? _raw_spin_unlock_irq+0x23/0x50 [ 1448.821945][T17676] ? process_scheduled_works+0x9ef/0x17b0 [ 1448.821964][T17676] ? process_scheduled_works+0x9ef/0x17b0 [ 1448.821984][T17676] process_scheduled_works+0xae1/0x17b0 [ 1448.822012][T17676] ? __pfx_process_scheduled_works+0x10/0x10 [ 1448.822036][T17676] worker_thread+0x8a0/0xda0 [ 1448.822056][T17676] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1448.822076][T17676] ? __kthread_parkme+0x7b/0x200 [ 1448.822091][T17676] kthread+0x70e/0x8a0 [ 1448.822106][T17676] ? __pfx_worker_thread+0x10/0x10 [ 1448.822125][T17676] ? __pfx_kthread+0x10/0x10 [ 1448.822139][T17676] ? _raw_spin_unlock_irq+0x23/0x50 [ 1448.822156][T17676] ? lockdep_hardirqs_on+0x9c/0x150 [ 1448.822174][T17676] ? __pfx_kthread+0x10/0x10 [ 1448.822188][T17676] ret_from_fork+0x3fc/0x770 [ 1448.822207][T17676] ? __pfx_ret_from_fork+0x10/0x10 [ 1448.822226][T17676] ? __switch_to_asm+0x39/0x70 [ 1448.822239][T17676] ? __switch_to_asm+0x33/0x70 [ 1448.822252][T17676] ? __pfx_kthread+0x10/0x10 [ 1448.822266][T17676] ret_from_fork_asm+0x1a/0x30 [ 1448.822284][T17676] [ 1449.189287][T20219] usb 4-1: config 0 descriptor?? [ 1449.253933][T20219] ftdi_sio 4-1:0.130: FTDI USB Serial Device converter detected [ 1449.276671][T20219] ftdi_sio ttyUSB0: unknown device type: 0x711b [ 1449.508848][ T5895] isku 0003:1E7D:319C.004A: couldn't init struct isku_device [ 1449.516829][ T5895] isku 0003:1E7D:319C.004A: couldn't install keyboard [ 1449.525315][ T5895] isku 0003:1E7D:319C.004A: probe with driver isku failed with error -71 [ 1449.536621][ T5895] usb 3-1: USB disconnect, device number 103 [ 1449.593384][T17676] mac80211_hwsim hwsim21 wlan1 (unregistering): left allmulticast mode [ 1449.681788][T17676] team0: Port device wlan1 removed [ 1449.845345][T17676] hsr_slave_0: left promiscuous mode [ 1449.858343][T17676] hsr_slave_1: left promiscuous mode [ 1449.891222][T17676] team0: left allmulticast mode [ 1449.902584][T17676] team_slave_0: left allmulticast mode [ 1449.971247][T17676] team_slave_1: left allmulticast mode [ 1449.979128][T17676] team0: left promiscuous mode [ 1449.985444][T17676] team_slave_0: left promiscuous mode [ 1449.990916][T17676] team_slave_1: left promiscuous mode [ 1449.998728][T17676] veth1_macvtap: left promiscuous mode [ 1450.004362][T17676] veth0_macvtap: left promiscuous mode [ 1450.327401][T17676] team0 (unregistering): Port device team_slave_1 removed [ 1450.378138][T17676] team0 (unregistering): Port device team_slave_0 removed [ 1450.854998][T17676] IPVS: stop unused estimator thread 0... [ 1451.652474][T12480] usb 4-1: USB disconnect, device number 121 [ 1451.659300][T12480] ftdi_sio 4-1:0.130: device disconnected